Fortinet Advises Immediate Upgrade to Fix Critical FortiSwitch Vulnerability
Fortinet is advising FortiSwitch users to urgently update their firmware to fix a critical vulnerability that could be exploited by a remote attacker to modify administrative passwords. The vulnerability is tracked as CVE-2024-4887, has a CVSS base score of 9.3, and was discovered internally by Daniel Rozeboom of the FortiSwitch web UI development team.
The vulnerability is present in FortiSwitch GUI and can be exploited remotely by sending a specially crafted request. Users have been advised to upgrade to a patched version as soon as possible to prevent exploitation. Vulnerabilities in Fortinet products are regularly targeted by threat actors, although at the time of issuing the security alert, Fortinet was unaware of any instances of attempted exploitation in the wild.
If immediate patching is not possible, Fortinet recommends disabling HTTP/HTTPS Access from administrative interfaces and configuring trusted hosts to limit the hosts that can connect to the system.
| Affected Versions | Fixed versions |
| FortiSwitch 7.6.0 | FortiSwitch 7.6.1 and above |
| FortiSwitch 7.4.0 to 7.4.4 | FortiSwitch 7.4.5 and above |
| FortiSwitch 7.2.0 to 7.2.8 | FortiSwitch 7.2.9 and above |
| FortiSwitch 7.0.0 to 7.0.10 | FortiSwitch 7.0.11 and above |
| FortiSwitch 6.4.0 to 6.4.14 | FortiSwitch 6.4.15 and above |
The vulnerability was one of ten to be fixed on April 2025 Patch Tuesday. Other notable vulnerabilities include two high-severity vulnerabilities affecting multiple FortiAnalyzer, FortiManager, FortiOS, FortiProxy, FortiVoice, and FortiWeb versions. The vulnerabilities are tracked as CVE-2024-26013 and CVE-2024-50565, and both have a CVSS base score of 7.1.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The vulnerabilities are due to improper restriction of communication channel to intended endpoints and could be exploited by an unauthenticated attacker in a man-in-the-middle (MitM) attack. An attacker could impersonate the management device – FortiCloud server or FortiManager – and intercept FGFM authentication requests between management and the managed device.
