CVE-2016-4573

Critical

Published: 09/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Fortinet FortiSwitch models in FortiLink managed mode, when upgraded to version 3.4.1, may allow remote attackers to bypass authentication and gain administrative access via an empty password for the rest_admin account.

Risk Assessment

Attackers could gain full access to the devices, potentially leading to serious security breaches within the organization's network.

Recommendation

It is recommended to immediately update the firmware to the latest version and configure strong passwords for administrative accounts.

Original NVD description (English source)

Fortinet FortiSwitch FSW-108D-POE, FSW-124D, FSW-124D-POE, FSW-224D-POE, FSW-224D-FPOE, FSW-248D-POE, FSW-248D-FPOE, FSW-424D, FSW-424D-POE, FSW-424D-FPOE, FSW-448D, FSW-448D-POE, FSW-448D-FPOE, FSW-524D, FSW-524D-FPOE, FSW-548D, FSW-548D-FPOE, FSW-1024D, FSW-1048D, FSW-3032D, and FSW-R-112D-POE models, when in FortiLink managed mode and upgraded to 3.4.1, might allow remote attackers to bypass authentication and gain administrative access via an empty password for the rest_admin account.