Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2024-48887

🗓️ 08 Apr 2025 16:52:02Reported by fortinetType 
cve
 cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 119 Views🌐 WEB

Unverified password change vulnerability in Fortinet FortiSwitch allows remote attacks.

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
ATTACKERKB		CVE-2024-48887
8 Apr 202517:15
–attackerkb
BDU FSTEC		The vulnerability of the authentication system for microprogrammed Ethernet switch FortiSwitch lies in the lack of necessary checks when changing passwords via the graphical user interface. This allows attackers to escalate their privileges.
9 Apr 202500:00
–bdu_fstec
GithubExploit		Exploit for Unverified Password Change in Fortinet Fortiswitch
9 Apr 202517:27
–githubexploit
Circl		CVE-2024-48887
8 Apr 202515:53
–circl
CNNVD		Fortinet FortiSwitch 安全漏洞
8 Apr 202500:00
–cnnvd
CNVD		Fortinet FortiSwitch Authorization Issues Vulnerability
18 Apr 202500:00
–cnvd
Cvelist		CVE-2024-48887
8 Apr 202516:52
–cvelist
EUVD		EUVD-2025-10266
3 Oct 202520:07
–euvd
NCSC		Vulnerability fixed in FortiSwitch
9 Apr 202506:49
–ncsc
NVD		CVE-2024-48887
8 Apr 202517:15
–nvd
Rows per page
NVD
Node
fortinetfortiswitchRange6.4.0–6.4.15
OR
fortinetfortiswitchRange7.0.0–7.0.11
OR
fortinetfortiswitchRange7.2.0–7.2.9
OR
fortinetfortiswitchRange7.4.0–7.4.5
OR
fortinetfortiswitchMatch7.6.0
[
  {
    "vendor": "Fortinet",
    "product": "FortiSwitch",
    "cpes": [
      "cpe:2.3:a:fortinet:fortiswitch:7.6.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.4.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.4.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.4.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.4.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.14:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.6.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.4.0",
        "lessThanOrEqual": "7.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.14",
        "status": "affected"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
usernamerequest body/change_passUnauthenticated password change via vulnerable FortiSwitch GUI endpoint.CWE-620
newpassrequest body/change_passUnauthenticated password change via vulnerable FortiSwitch GUI endpoint.CWE-620
confirmrequest body/change_passUnauthenticated password change via vulnerable FortiSwitch GUI endpoint.CWE-620

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
23 Jul 2025 16:03Current
7.4High risk
Vulners AI Score7.4
CVSS 3.19.8
EPSS0.02492
SSVC
CWE-620
fortinet fortiswitchpassword change vulnerabilityremote attackerunauthenticated access
119