- Fortinet found an escalation of privilege flaw in multiple versions of FortiSwitch
- The flaw was given a critical severity score
- A patch and a mitigation measure are both available
Fortinet has patched a critical severity vulnerability in FortiSwitch which allowed malicious actors to change users’ login credentials.
In a short security advisory published earlier this week, the company detailed the escalation of privilege flaw, the versions of FortiSwitch which were affected, and suggested a workaround for those unable to patch things up immediately.
The bug is tracked as SWE-620, and was given a severity score of 9.3/10 (critical). Per NVD, it’s tracked as CVE-2024-48887 and has an even worse severity score – 9.8/10. Apparently, the bug was found in the password reset form, which can be forced to provide the original password, as well.
Working around the bug
“Do not use “forgotten password” functionality,” the MITRE corporation explained in its advisory. “But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.”
Affected versions include FortiSwitch 6.4 through 6.4.14, 7.0 through 7.0.10, 7.2 through 7.2.8, 7.4 through 7.4.4, and 7.6. Users should upgrade to the newest version of the tool to mitigate the flaw.
Those that cannot apply the fixes immediately are advised to deploy the workaround instead, and disable HTTP/HTTPS access from administrative interfaces.
Fortinet FortiSwitch is a family of secure, high-performance Ethernet switches designed to integrate tightly with Fortinet’s security fabric, particularly FortiGate firewalls. It’s mostly used in business environments, which makes it a highly sought target. Firewalls, switches, and hubs are a great stepping stone into the entire target network and towards bigger, bolder targets.
Via The Hacker News