FG-IR-23-260: Hardcoded Session Secret Leading to Unauthenticated Remote Code Execution
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiSwitch may allow a remote unauthenticated attacker in posession of the key to execute unauthorized code via crafted cryptographic requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-260?
The severity of FG-IR-23-260 is critical due to its potential to allow remote code execution by an unauthenticated attacker.
How do I fix FG-IR-23-260?
To fix FG-IR-23-260, update FortiSwitch to a version that is patched against this vulnerability, such as versions 7.4.1 or later.
What software versions are affected by FG-IR-23-260?
FG-IR-23-260 affects multiple versions of FortiSwitch, including those ranging from 6.0.0 to 7.2.5.
Can FG-IR-23-260 be exploited remotely?
Yes, FG-IR-23-260 can be exploited remotely by an attacker in possession of the hard-coded cryptographic key.
What is the impact of FG-IR-23-260 on FortiSwitch systems?
The impact of FG-IR-23-260 on FortiSwitch systems is the potential execution of unauthorized code, compromising system integrity and security.