Hardcoded Session Secret Leading to Unauthenticated Remote Code Execution
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-23-260
Final
1
1
2025-01-14T00:00:00
Current version
2025-01-14T00:00:00
2025-01-14T00:00:00
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiSwitch may allow a remote unauthenticated attacker in posession of the key to execute unauthorized code via crafted cryptographic requests.
None
Execute unauthorized code or commands
This was discovered during an independent source code audit commissioned by Fortinet.
FortiSwitch 7.4.0
FortiSwitch 7.2.5
FortiSwitch 7.2.4
FortiSwitch 7.2.3
FortiSwitch 7.2.2
FortiSwitch 7.2.1
FortiSwitch 7.2.0
FortiSwitch 7.0.7
FortiSwitch 7.0.6
FortiSwitch 7.0.5
FortiSwitch 7.0.4
FortiSwitch 7.0.3
FortiSwitch 7.0.2
FortiSwitch 7.0.1
FortiSwitch 7.0.0
FortiSwitch 6.4.13
FortiSwitch 6.4.12
FortiSwitch 6.4.11
FortiSwitch 6.4.10
FortiSwitch 6.4.9
FortiSwitch 6.4.8
FortiSwitch 6.4.7
FortiSwitch 6.4.6
FortiSwitch 6.4.5
FortiSwitch 6.4.4
FortiSwitch 6.4.3
FortiSwitch 6.4.2
FortiSwitch 6.4.1
FortiSwitch 6.4.0
FortiSwitch 6.2.7
FortiSwitch 6.2.6
FortiSwitch 6.2.5
FortiSwitch 6.2.4
FortiSwitch 6.2.3
FortiSwitch 6.2.2
FortiSwitch 6.2.1
FortiSwitch 6.2.0
FortiSwitch 6.0.7
FortiSwitch 6.0.6
FortiSwitch 6.0.5
FortiSwitch 6.0.4
FortiSwitch 6.0.3
FortiSwitch 6.0.2
FortiSwitch 6.0.1
FortiSwitch 6.0.0
Hardcoded Session Secret Leading to Unauthenticated Remote Code Execution
CVE-2023-37936
FortiSwitch-7.4.0
FortiSwitch-7.2.5
FortiSwitch-7.2.4
FortiSwitch-7.2.3
FortiSwitch-7.2.2
FortiSwitch-7.2.1
FortiSwitch-7.2.0
FortiSwitch-7.0.7
FortiSwitch-7.0.6
FortiSwitch-7.0.5
FortiSwitch-7.0.4
FortiSwitch-7.0.3
FortiSwitch-7.0.2
FortiSwitch-7.0.1
FortiSwitch-7.0.0
FortiSwitch-6.4.13
FortiSwitch-6.4.12
FortiSwitch-6.4.11
FortiSwitch-6.4.10
FortiSwitch-6.4.9
FortiSwitch-6.4.8
FortiSwitch-6.4.7
FortiSwitch-6.4.6
FortiSwitch-6.4.5
FortiSwitch-6.4.4
FortiSwitch-6.4.3
FortiSwitch-6.4.2
FortiSwitch-6.4.1
FortiSwitch-6.4.0
FortiSwitch-6.2.7
FortiSwitch-6.2.6
FortiSwitch-6.2.5
FortiSwitch-6.2.4
FortiSwitch-6.2.3
FortiSwitch-6.2.2
FortiSwitch-6.2.1
FortiSwitch-6.2.0
FortiSwitch-6.0.7
FortiSwitch-6.0.6
FortiSwitch-6.0.5
FortiSwitch-6.0.4
FortiSwitch-6.0.3
FortiSwitch-6.0.2
FortiSwitch-6.0.1
FortiSwitch-6.0.0
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
https://fortiguard.fortinet.com/psirt/FG-IR-23-260
Hardcoded Session Secret Leading to Unauthenticated Remote Code Execution
Reference>