CVE-2024-48887

—

CVSS 3.1

9.8 critical

EPSS

15%p96

Published

Apr 8, 2025 (Apr 8, 2025)

Modified

Jun 17, 2026

Description

A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request

Vendors: fortinet
Products: fortiswitch
Weakness: CWE-620
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (14.9%)

In the news5 stories

⚡ Weekly Recap: Windows 0-Day, VPN Exploits, Weaponized AI, Hijacked Antivirus and More

The Hacker NewsMay 6, 07:05 UTC · May 6, 2025Ransomware CVE-2025-29824 CVE-2024-11859 CVE-2025-3102+17 CVEs

Week in review: Microsoft patches exploited Windows CLFS 0-day, WinRAR MotW bypass flaw fixed

Help Net SecurityApr 13, 00:00 UTC · Apr 13, 2025Vulnerability in the wildCVE-2025-29824 CVE-2025-31334 CVE-2024-48887+2 CVEs1

FortiSwitch vulnerability may give attackers control over vulnerable devices (CVE-2024-48887)

Help Net SecurityApr 10, 00:00 UTC · Apr 10, 2025Vulnerability in the wildCVE-2024-48887

Critical Fortinet FortiSwitch flaw allows remote attackers to change admin passwords

Security AffairsApr 9, 17:51 UTC · Apr 9, 2025Vulnerability CVE-2024-48887 CVE-2024-26010

Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw

The Hacker NewsApr 8, 17:53 UTC · Apr 8, 2025Vulnerability CVE-2024-48887