CVE-2023-37937: OS Command Injection
First published: Tue Jan 14 2025(Updated: )
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via the FortiSwitch CLI.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiSwitch | >=7.2.0<7.2.5>=7.0.0<7.0.7>=6.4.0<6.4.13>=6.2.0<6.2.7>=6.0.0<6.0.7 | |
| Fortinet FortiSwitch | >=6.0.0<6.2.8 | |
| Fortinet FortiSwitch | >=6.4.0<6.4.14 | |
| Fortinet FortiSwitch | >=7.0.0<7.0.8 | |
| Fortinet FortiSwitch | >=7.2.0<7.2.6 | |
| Fortinet FortiSwitch | =7.4.0 |
Remedy
Please upgrade to FortiSwitch version 7.4.1 or above Please upgrade to FortiSwitch version 7.2.6 or above Please upgrade to FortiSwitch version 7.0.8 or above Please upgrade to FortiSwitch version 6.4.14 or above Please upgrade to FortiSwitch version 6.2.8 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-37937?
CVE-2023-37937 is considered a critical vulnerability due to its potential to allow attackers to execute unauthorized code on affected Fortinet FortiSwitch devices.
How do I fix CVE-2023-37937?
To fix CVE-2023-37937, upgrade Fortinet FortiSwitch to a non-vulnerable version, specifically version 7.4.1 or higher, or apply recommended security patches.
Which versions of Fortinet FortiSwitch are affected by CVE-2023-37937?
CVE-2023-37937 affects FortiSwitch versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.7, 6.4.0 through 6.4.13, 6.2.0 through 6.2.7, and 6.0.0 through 6.0.7.
What type of vulnerability is CVE-2023-37937?
CVE-2023-37937 is categorized as an OS command injection vulnerability that results from improper neutralization of special elements in commands.
Can CVE-2023-37937 be exploited remotely?
Yes, CVE-2023-37937 can be exploited remotely, allowing attackers to execute harmful commands on affected Fortinet FortiSwitch devices.
- agent/references
- agent/weakness
- agent/remedy
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/fortinet
- canonical/fortinet fortiswitch
- version/fortinet fortiswitch/6.0.0
- version/fortinet fortiswitch/6.4.0
- version/fortinet fortiswitch/7.0.0
- version/fortinet fortiswitch/7.2.0
- version/fortinet fortiswitch/7.4.0