CVE-2023-37936: Critical Hard-coded Key in Fortinet FortiSwitch

CVE-2023-37936 is a critical flaw (CVSS 9.8) in Fortinet FortiSwitch. A hard-coded cryptographic key lets a remote, unauthenticated attacker who holds the key run unauthorized code or commands through crafted requests. Fortinet lists fixed releases per branch: 7.4.1, 7.2.6, 7.0.8, 6.4.14 and 6.2.8. Upgrade to the one for your branch.

What's affected

Fortinet advisory FG-IR-23-260, published on 14 January 2025, lists these FortiSwitch versions and solutions:

• 7.6: not affected.
• 7.4: 7.4.0 is affected. Upgrade to 7.4.1 or above.
• 7.2: 7.2.0 through 7.2.5 are affected. Upgrade to 7.2.6 or above.
• 7.0: 7.0.0 through 7.0.7 are affected. Upgrade to 7.0.8 or above.
• 6.4: 6.4.0 through 6.4.13 are affected. Upgrade to 6.4.14 or above.
• 6.2: 6.2.0 through 6.2.7 are affected. Upgrade to 6.2.8 or above.
• 6.0: 6.0.0 through 6.0.7 are affected. Migrate to a fixed release.

Fortinet says the issue was found internally, during an independent source code audit it commissioned, and marks Known Exploited as No on its advisory.

How to check if you're exposed

On each FortiSwitch, read the firmware version from the command line:

get system status

The output includes the version. Compare it with the table above. The Fortinet management system, FortiGate switch controller or FortiManager, can also list the firmware of every managed switch in one view, which saves logging in to each device.

Then check who can reach the switch management plane. The advisory describes a remote unauthenticated attacker, so management interfaces should be limited to a dedicated network and to named admin hosts. Look for any management address reachable from user VLANs or from the internet.

What to do now

1. Build a list of all FortiSwitch units with model and firmware version.
2. Pick the fixed release for each branch from the advisory, and schedule upgrades starting with units whose management plane is the most exposed.
3. For 6.0 units, plan migration to a supported branch, since Fortinet lists no fix inside 6.0.
4. Restrict management access to a dedicated network and to specific admin hosts.
5. After the upgrade, confirm the version again and review configuration backups for unexpected changes.

Why it matters

The weakness is the use of a hard-coded cryptographic key (CWE-321) and, more broadly, hard-coded credentials (CWE-798). A key built into a product is the same on every device that ships that firmware. Once it is known, it works everywhere, and it cannot be rotated by the customer because it is not a setting. The advisory words the attack as requiring possession of the key, which is a reason Fortinet handles it as an audit finding, but the CVSS vector in the record still scores it 9.8 with no privileges required.

Switches carry every packet in a network segment, and an attacker who can run code on one has a good position for observing or redirecting traffic. Network devices also tend to be patched less often than servers, which makes advisories like this one easy to lose. Fortinet marks it as not known to be exploited. It is not on the CISA Known Exploited Vulnerabilities list, so patching can follow your normal change process, but it should be on a dated plan.

Where this fits in your backlog

Hard-coded key issues are a good test of a vulnerability management process. The device does not show up in a language dependency scan, the CVE is more than a year old by the time you see it, and the fix is a firmware upgrade that needs a maintenance window. Keep network gear in the same inventory as your software, record the firmware version beside each device, and give the upgrade an owner and a date. The Gold directory entry for this CVE is a useful starting reference for ticket text.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Fortinet PSIRT advisory FG-IR-23-260

Last reviewed: 19 October 2026.