CVE-2023-47537: 
FortiOS vulnerability analysis and mitigation

An improper certificate validation vulnerability (CVE-2023-47537) was discovered in Fortinet FortiOS affecting versions 7.0.0 through 7.0.15, 7.2.0 through 7.2.6, 7.4.0 through 7.4.1, and all versions of 6.4. The vulnerability was initially disclosed on February 8, 2024, and was reported by Christian Hilgers from Indevis under responsible disclosure. This security issue received a CVSSv3 score of 4.4, categorizing it as Medium severity (Fortinet PSIRT).

The vulnerability is classified as an improper certificate validation issue [CWE-295] that affects the FortiLink communication channel between FortiOS devices and FortiSwitch instances. The vulnerability allows an unauthenticated attacker in a Man-in-the-Middle position to potentially intercept and manipulate communications between these components (NVD).

If exploited, this vulnerability could lead to information disclosure and potential manipulation of the FortiLink communication channel between the FortiOS device and FortiSwitch. The attacker could potentially decipher and alter the communications between these components (Fortinet PSIRT).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to the following versions: FortiOS 7.4.2 or above for 7.4 branch, FortiOS 7.2.7 or above for 7.2 branch, and FortiOS 7.0.16 or above for 7.0 branch. Users of FortiOS 6.4 are recommended to migrate to a fixed release. The upgrade should be performed following Fortinet's recommended upgrade path tool (Fortinet PSIRT).