CVE-2024-48887

A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to change admin passwords via a specially crafted request

Scoring

Severity

CRITICAL

CVSS base score

9.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

EPSS probability

14.91%

CWE

CWE-620

Published

2025-04-08

Last modified

2026-03-13

Affected products

• Fortinet FortiSwitch
• Fortinet FortiSwitch
• Fortinet FortiSwitch
• Fortinet FortiSwitch
• Fortinet FortiSwitch

Weakness type

• CWE-620

Related vulnerabilities

• CVE-2026-86260 — sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change
• CVE-2026-85591 — phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
• CVE-2026-77644 — Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
• CVE-2026-76633 — WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
• CVE-2026-73292 — Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
• CVE-2026-17599 — Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
• CVE-2026-15964 — Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
• CVE-2026-12692 — Improper Authentication in Vimesoft's Enterprise Video Platform

Markdown version · Browse all CVEs