CVE-2024-48887

The password change mechanism in FortiSwitch GUI does not verify the identity of the requester — proper authentication is missing before executing the password modification operation (CWE-620: Unverified Password Change). The attacker sends a properly crafted HTTP request to the management interface, bypassing all access control mechanisms. As a result, the administrator account password is overwritten with a value controlled by the attacker without requiring knowledge of the current password or possessing an active session.

An attacker can gain full administrative control over the FortiSwitch device, enabling modification of network configuration, disabling security measures, lateral movement within the infrastructure, and further compromise of the network environment.

Apply patches available from the manufacturer according to references (https://fortiguard.fortinet.com/psirt/FG-IR-24-435). As an interim remedial measure, it is recommended to restrict access to the FortiSwitch GUI interface exclusively to trusted IP addresses through firewall rules and to disable GUI access from untrusted networks if not strictly necessary.

Fortinet FortiSwitch — versions specified in manufacturer references (bulletin FG-IR-24-435)