CVE-2024-48887criticalCWE-620

CVE-2024-48887: critical vulnerability in Fortinet FortiSwitch

Published · Updated

Follow this CVE+ Monitor FortiSwitch

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert and has a public proof of concept.

ssvc Attendcvss 9.3epss 16%
from disclosure to weapon1 day
Published on NVDApr 8
1st PoC+1d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 07/2025Vulnerabilidade crítica no produto FortiSwitchread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
Affected products
Fortinet · FortiSwitch
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiSwitch

In the same product, most dangerous first.

CVE-2023-37936CRITICALCVE-2023-37936EPSS 1.0%CVE-2023-37937HIGHCVE-2023-37937EPSS 0.5%CVE-2021-42757MEDIUMCVE-2021-42757EPSS 0.5%CVE-2022-27488HIGHCVE-2022-27488EPSS 0.5%CVE-2022-27490MEDIUMCVE-2022-27490EPSS 0.5%CVE-2022-23439MEDIUMCVE-2022-23439EPSS 0.5%