PT-2023-4880 · Fortinet · Fortiswitchmanager

Published 2023-09-07 · Updated 2023-09-12 · CVE-2023-36635

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiSwitchManager versions 7.0.0 through 7.0.1 Fortinet FortiSwitchManager versions 7.2.0 through 7.2.2

Description The issue is related to improper access control in Fortinet FortiSwitchManager, which may allow a remote authenticated read-only user to modify interface settings via the API. This can be achieved by sending commands through the application programming interface.

Recommendations For Fortinet FortiSwitchManager versions 7.0.0 through 7.0.1, consider restricting access to the API to prevent unauthorized modifications to interface settings until a patch is available. For Fortinet FortiSwitchManager versions 7.2.0 through 7.2.2, consider disabling the API functionality temporarily to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-05371

CVE-2023-36635

Affected Products

Fortiswitchmanager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-36635 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36635 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05371 · Security Note
• https://twitter.com/cracbot/status/1700026239011164348 · Twitter Post
• https://twitter.com/CVEnew/status/1699767676501905612 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1699795765600858430 · Twitter Post
• https://t.me/cibsecurity/70068 · Telegram Post