CVE-2023-37936
Published: 14 January 2025
Summary
CVE-2023-37936 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Fortinet Fortiswitch. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 22.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-12 (Cryptographic Key Establishment and Management) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely remediation of identified flaws, such as patching the hard-coded cryptographic key vulnerability to prevent remote unauthorized code execution.
Requires establishment and management of cryptographic keys without hard-coding, directly mitigating the root cause of this vulnerability.
Provides for vulnerability scanning to identify the hard-coded key flaw in affected FortiSwitch versions, enabling proactive patching.
NVD Description
A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via…
more
crafted requests.
Deeper analysisAI
CVE-2023-37936 is a critical vulnerability stemming from the use of a hard-coded cryptographic key in Fortinet FortiSwitch, affecting versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.7, 6.4.0 through 6.4.13, 6.2.0 through 6.2.7, and 6.0.0 through 6.0.7. Mapped to CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-798 (Use of Hard-coded Credentials), it enables attackers to execute unauthorized code or commands through crafted requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.
A remote, unauthenticated attacker can exploit this flaw over the network with low complexity and no user interaction required. By leveraging the hard-coded key, the attacker crafts malicious requests to bypass authentication or encryption mechanisms, achieving arbitrary code execution or command injection on the affected FortiSwitch device. This grants high-impact confidentiality, integrity, and availability violations, potentially leading to full control over the switch and lateral movement within the network.
Fortinet has published a detailed advisory at https://fortiguard.com/psirt/FG-IR-23-260, which security practitioners should consult for patch availability, workaround guidance, and affected product confirmation. Upgrading to a patched version is the primary recommended mitigation.
Details
- CWE(s)