A critical buffer overflow vulnerability in Fortinet FortiSwitchAXFixed devices allows unauthenticated remote code execution, posing a severe risk to network infrastructure.

This is a classic buffer overflow flaw (CWE-120) occurring when the device processes maliciously crafted Link Layer Discovery Protocol (LLDP) packets. An unauthenticated attacker positioned on the same adjacent network can trigger this condition to achieve unauthorized code execution on the target device.

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected network switch, leading to a complete compromise of network traffic integrity and confidentiality. Given the CVSS score of 8.8, this represents a high-severity risk that could facilitate lateral movement, facilitate man-in-the-middle attacks, or result in prolonged denial of service for critical network segments.

Immediate Action: Update FortiSwitchAXFixed to version 1.0.2 or later, or upgrade to FortiSwitchAX-Chassis version 1.0.0 or above, as specified in the vendor security advisory.

Proactive Monitoring: Monitor network traffic for malformed or unusually large LLDP packets and review device system logs for unexpected crashes or reboot events.

Compensating Controls: If patching is not immediately feasible, consider disabling LLDP on untrusted switch ports or implementing network segmentation to restrict access to the management plane from unauthorized segments.

Public Exploit Available: No (exploit_available: false)

Fortinet administrators must prioritize the deployment of the provided firmware updates to address this buffer overflow vulnerability. Given the nature of the flaw, which allows for full system compromise without authentication, failure to patch leaves the internal network infrastructure vulnerable to unauthorized code execution by any actor capable of sending LLDP traffic.