Fortinet has issued urgent security updates to fix a critical vulnerability in FortiSwitch devices that could allow unauthorized password changes. The flaw, identified as CVE-2024-48887, has received a severe CVSS score of 9.3 out of 10.

“An unverified password change vulnerability in FortiSwitch GUI may allow a remote unauthenticated attacker to modify admin passwords via a specially crafted request,” Fortinet stated in their advisory.

## Affected Versions

The vulnerability impacts multiple FortiSwitch versions:
– FortiSwitch 7.6.0 (Upgrade to 7.6.1+)
– FortiSwitch 7.4.0 through 7.4.4 (Upgrade to 7.4.5+)
– FortiSwitch 7.2.0 through 7.2.8 (Upgrade to 7.2.9+)
– FortiSwitch 7.0.0 through 7.0.10 (Upgrade to 7.0.11+)
– FortiSwitch 6.4.0 through 6.4.14 (Upgrade to 6.4.15+)

The vulnerability was discovered internally by Daniel Rozeboom from the FortiSwitch web UI development team.

## Recommended Actions

While no exploitation has been detected yet, Fortinet recommends:
1. Applying the patches immediately
2. Disabling HTTP/HTTPS access from administrative interfaces
3. Restricting system access to trusted hosts only

Given that previous Fortinet vulnerabilities have been actively exploited by threat actors, administrators should prioritize these security updates to protect their network infrastructure.