PT-2025-1190 · Fortinet · Fortiswitch

Published

2025-01-14

·

Updated

2025-01-15

·

CVE-2023-37937

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Fortinet FortiSwitch versions 6.0.0 through 6.0.7 Fortinet FortiSwitch versions 6.2.0 through 6.2.7 Fortinet FortiSwitch versions 6.4.0 through 6.4.13 Fortinet FortiSwitch versions 7.0.0 through 7.0.7 Fortinet FortiSwitch versions 7.2.0 through 7.2.5 Fortinet FortiSwitch version 7.4.0
Description The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection', in Fortinet FortiSwitch. This allows an attacker to execute unauthorized code or commands via the FortiSwitch CLI. The exploitation of this issue may enable an attacker to perform arbitrary code execution.
Recommendations For Fortinet FortiSwitch versions 6.0.0 through 6.0.7, update to a version that contains a fix for this issue. For Fortinet FortiSwitch versions 6.2.0 through 6.2.7, update to a version that contains a fix for this issue. For Fortinet FortiSwitch versions 6.4.0 through 6.4.13, update to a version that contains a fix for this issue. For Fortinet FortiSwitch versions 7.0.0 through 7.0.7, update to a version that contains a fix for this issue. For Fortinet FortiSwitch versions 7.2.0 through 7.2.5, update to a version that contains a fix for this issue. For Fortinet FortiSwitch version 7.4.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the FortiSwitch CLI to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00473
CVE-2023-37937

Affected Products

Fortiswitch