Fortinet FortiSwitch – Unverified Password Change Vulnerability

**CVE-2024-48887 — FortiSwitch unauthenticated password change (Critical, CVSS 9.3):** Fortinet disclosed a critical GUI vulnerability in multiple FortiSwitch versions that permits unauthenticated attackers to send crafted HTTP requests to change administrator passwords and execute commands on the device; Fortinet released patched versions and vendors/defenders are advised to apply updates, segment management interfaces, enable MFA, monitor logs, and deploy detection rules while no public PoC or confirmed exploitation in the wild has been observed.