Critical FortiSwitch flaw lets hackers change admin passwords remotely

Fortinet has released security patches for a critical vulnerability in its FortiSwitch devices that can be exploited to change administrator passwords remotely. The company says Daniel Rozeboom of the FortiSwitch web UI development team discovered the vulnerability (CVE-2024-48887) internally. Unauthenticated attackers can exploit this unverified FortiSwitch GUI password change security flaw (rated with a 9.8/10 severity score) in low-complexity attacks that don't require user interaction. Fortinet says threat actors can change credentials using a specially crafted request sent via the set_password endpoint. "An unverified password change vulnerability [CWE-620] in FortiSwitch GUI may allow a remote unauthenticated attacker to modify admin passwords via a specially crafted request," Fortinet says. CVE-2024-48887 impacts multiple FortiSwitch versions, from FortiSwitch 6.4.0 and up to FortiSwitch 7.6.0, and was addressed in FortiSwitch versions 6.4.15, 7.0.11, 7.2.9, 7.4.5, and 7.6.1. Cybersecurity company Censys says it found 864 exposed FortiSwitch instances online. However, no information is available on how many have already been patched. For those who can't immediately apply the security updates released on Tuesday, Fortinet also provides a temporary workaround requiring them to disable 'HTTP/HTTPS Access' from administrative interfaces and restrict access to vulnerable FortiSwitch devices to trusted hosts. On Tuesday, the company also patched an OS command injection (CVE...