Latest FortiSwitch vulnerability: CVE-2024-48887 #
Fortinet has issued an advisory (see FortiGuard) for its Fortinet FortiSwitch product. An unauthenticated user may be able to exploit a vulnerability in the web administration interface to change the password for an administrative account. Successfully exploiting this vulnerability would allow an attacker to gain administrative privileges on the vulnerable device.
This vulnerability has been designated CVE-2024-48887 and has been assigned a CVSS score of 9.3 (extremely critical).
What is the impact? #
This vulnerability would allow an attacker to gain administrative privileges on the vulnerable device.
Are updates or workarounds available? #
The vendor has released updates to address this issue, and the vendor advises users to update as quickly as possible. Mitigation strategies include disabling the affected web administrative interface.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
hw:FortiSwitch
