An improper access control flaw in Fortinet FortiSwitchAXFixed versions 1.0.0 through 1.0.1 allows an authenticated administrator to craft a specially designed SSH configuration file that enables execution of arbitrary system commands on the device. The weakness permits the privileged user to run commands with the full operating‑system rights of the switch, potentially leading to complete compromise of the device’s operating environment.

Fortinet FortiSwitchAXFixed 1.0.0 and 1.0.1 are affected. Upgrading to FortiSwitchAXFixed 1.0.2 or newer, or FortiSwitchAX-Chassis 1.0.0 or newer, removes the vulnerability.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need legitimate administrator credentials and access to the device’s SSH configuration, but once available, can issue arbitrary system commands. The impact is high for any privileged operator, enabling full control of the switch if the flaw is used.