CVE-2023-47537

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-47537
An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.com/psirt/FG-IR-23-301 Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-301 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*
History

14 Jan 2026, 10:16

Type Values Removed Values Added
Summary (en) An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6, 7.4.0 - 7.4.1 and 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch. (en) An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.

21 Nov 2024, 08:30

Type Values Removed Values Added
References () https://fortiguard.com/psirt/FG-IR-23-301 - Vendor Advisory () https://fortiguard.com/psirt/FG-IR-23-301 - Vendor Advisory

21 May 2024, 10:15

Type Values Removed Values Added
Summary (en) An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6 and 7.4.0 - 7.4.1 allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch. (en) An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6, 7.4.0 - 7.4.1 and 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.

22 Feb 2024, 15:26

Type Values Removed Values Added
References () https://fortiguard.com/psirt/FG-IR-23-301 - () https://fortiguard.com/psirt/FG-IR-23-301 - Vendor Advisory
First Time Fortinet
Fortinet fortios
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
CPE cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*

15 Feb 2024, 14:28

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-15 14:15

Updated : 2026-01-14 10:16

NVD link : CVE-2023-47537

Mitre link : CVE-2023-47537

CVE.ORG link : CVE-2023-47537

JSON object : View

Products Affected

fortinet

  • fortios
CWE
CWE-295

Improper Certificate Validation