CVE-2023-37936: Fortinet FortiSwitch RCE Vulnerability

CVE-2023-37936 Overview

CVE-2023-37936 is a critical vulnerability affecting Fortinet FortiSwitch network switches that stems from the use of a hard-coded cryptographic key. This weakness allows remote, unauthenticated attackers to execute unauthorized code or commands by sending specially crafted requests to vulnerable devices. The vulnerability affects multiple major version branches of FortiSwitch firmware, representing a significant risk to enterprise network infrastructure.

Critical Impact

Remote attackers can leverage the hard-coded cryptographic key to execute arbitrary code or commands on FortiSwitch devices without authentication, potentially leading to complete device compromise and network infrastructure takeover.

Affected Products

• Fortinet FortiSwitch version 7.4.0
• Fortinet FortiSwitch versions 7.2.0 through 7.2.5
• Fortinet FortiSwitch versions 7.0.0 through 7.0.7
• Fortinet FortiSwitch versions 6.4.0 through 6.4.13
• Fortinet FortiSwitch versions 6.2.0 through 6.2.7
• Fortinet FortiSwitch versions 6.0.0 through 6.0.7

Discovery Timeline

• January 14, 2025 - CVE-2023-37936 published to NVD
• January 31, 2025 - Last updated in NVD database

Technical Details for CVE-2023-37936

Vulnerability Analysis

This vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key) and CWE-798 (Use of Hard-coded Credentials). The presence of a hard-coded cryptographic key in the FortiSwitch firmware fundamentally undermines the security model of the device. Because all devices share the same static key, an attacker who discovers or extracts this key can use it against any vulnerable FortiSwitch deployment worldwide.

The network-based attack vector means no physical access is required—an attacker with network connectivity to the management interface can exploit this vulnerability. The exploitation requires no privileges or user interaction, making it highly dangerous in environments where FortiSwitch management interfaces are exposed.

Root Cause

The root cause of CVE-2023-37936 is the inclusion of a static, hard-coded cryptographic key within the FortiSwitch firmware. This violates fundamental secure development practices, as cryptographic keys should be unique per device or deployment and never embedded in firmware that can be extracted or reverse-engineered.

Hard-coded keys create a systemic vulnerability because:

• The key value is identical across all affected firmware versions
• Firmware can be downloaded and analyzed to extract the key
• Once extracted, the key can be used to craft malicious requests targeting any vulnerable device

Attack Vector

The attack vector for CVE-2023-37936 is network-based, requiring the attacker to send crafted requests to vulnerable FortiSwitch devices. The attack flow typically involves:

1. Reconnaissance - Identifying FortiSwitch devices on the network through banner grabbing or service fingerprinting
2. Key Extraction/Knowledge - Obtaining the hard-coded cryptographic key through firmware analysis or from public disclosure
3. Request Crafting - Creating malicious requests that utilize the known cryptographic key to bypass authentication or integrity checks
4. Code Execution - Submitting the crafted requests to execute unauthorized code or commands on the target device

The vulnerability enables complete device compromise, allowing attackers to modify device configurations, intercept network traffic, establish persistence, or pivot to other network resources.

Detection Methods for CVE-2023-37936

Indicators of Compromise

• Unexpected administrative sessions or login events on FortiSwitch devices
• Unusual network traffic patterns to FortiSwitch management interfaces from untrusted sources
• Configuration changes not attributable to authorized administrators
• Anomalous outbound connections from FortiSwitch devices to external IP addresses
• Unexpected firmware modifications or file changes on affected devices

Detection Strategies

• Implement network monitoring to detect crafted requests targeting FortiSwitch management interfaces
• Review FortiSwitch logs for unauthorized command execution or authentication anomalies
• Deploy intrusion detection signatures for known exploitation patterns related to CVE-2023-37936
• Conduct firmware integrity verification to detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging on all FortiSwitch devices and forward logs to a centralized SIEM
• Monitor management interface access patterns and alert on connections from unauthorized IP addresses
• Implement network segmentation monitoring to detect lateral movement from compromised switches
• Establish baseline behavior for FortiSwitch devices and alert on deviations

How to Mitigate CVE-2023-37936

Immediate Actions Required

• Inventory all FortiSwitch devices and identify those running vulnerable firmware versions
• Restrict management interface access to trusted IP addresses using access control lists
• Isolate FortiSwitch management interfaces on a dedicated management VLAN with strict access controls
• Apply patches from Fortinet as soon as possible to eliminate the vulnerability

Patch Information

Fortinet has released security updates to address CVE-2023-37936. Organizations should upgrade to patched firmware versions as outlined in the FortiGuard Security Advisory FG-IR-23-260. The advisory provides specific version numbers and upgrade paths for each affected firmware branch.

Administrators should:

• Download patches only from official Fortinet sources
• Verify firmware integrity before deployment
• Test patches in a non-production environment when possible
• Plan maintenance windows for production device upgrades

Workarounds

• Implement strict network access controls to limit management interface exposure to trusted networks only
• Deploy a jump server or bastion host for all FortiSwitch management access
• Enable multi-factor authentication for administrative access where supported
• Monitor for and block network traffic patterns associated with exploitation attempts
• Consider implementing additional network-based security controls such as a web application firewall in front of management interfaces

# Example: Restrict management access to trusted subnet on FortiSwitch
config system interface
    edit "mgmt"
        set allowaccess ping https ssh
        set trusted-hosts 10.10.10.0/24
    next
end