CVE-2023-37937
Severity
7.8HIGH
EPSS
0.3%
top 46.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 14
Description
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via the FortiSwitch CLI.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages2 packages
🔴Vulnerability Details
2CVEList▶
CVE-2023-37937: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7↗2025-01-14
GHSA▶
GHSA-g347-74q4-mp7w: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSwitch version 7↗2025-01-14