PT-2016-6030 · Fortinet · Fortiswitch

Emma Ferguson · Published 2016-09-09 · Updated 2016-11-28 · CVE-2016-4573

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSwitch versions 3.4.1

Description The issue allows remote attackers to bypass authentication and gain administrative access via an empty password for the rest admin account when the FortiSwitch models are in FortiLink managed mode.

Recommendations For version 3.4.1, consider disabling the rest admin account until a patch is available to prevent potential exploitation. Restrict access to the administrative interface to minimize the risk of unauthorized access.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-4573

Affected Products

Fortiswitch

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-4573 · Security Note
• http://fortiguard.com/advisory/fortiswitch-rest-admin-account-exposed-under-specific-conditions · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4573 · Vendor Advisory
• http://securityfocus.com/bid/92450 · Note
• https://themissinglink.com.au/security/advisories/cve-2016-4573 · Note