A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Fortinet
  • Fortiswitch

No data.

No data.

References
Link Providers
https://fortiguard.fortinet.com/psirt/FG-IR-24-435 cve-icon cve-icon
History

Tue, 08 Apr 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Apr 2025 17:00:00 +0000

Type Values Removed Values Added
Description A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request
First Time appeared Fortinet
Fortinet fortiswitch
Weaknesses CWE-620
CPEs cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.6.0:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet fortiswitch
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C'}
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2025-04-09T04:00:33.735Z

Reserved: 2024-10-09T09:03:09.960Z

Link: CVE-2024-48887

cve-icon Vulnrichment

Updated: 2025-04-08T17:48:39.950Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-04-08T17:15:34.440

Modified: 2025-04-08T18:13:53.347

Link: CVE-2024-48887

cve-icon Redhat

No data.