iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Fortinet’s CVE-2024-47575 is a critical missing-authentication vulnerability that can let an unauthenticated remote attacker run code or commands on vulnerable FortiManager systems. Fortinet was aware of active exploitation by 24 October 2024. Attackers were reported to have exfiltrated files containing managed-device IP addresses, credentials, and configurations. Administrators should check their exact deployment against Fortinet’s current advisory, assess for compromise, and follow vendor recovery guidance if access or data exposure is suspected.
What happened in the FortiManager campaign?
The UK National Cyber Security Centre (NCSC) reported on 24 October 2024 that Fortinet was aware of active exploitation of CVE-2024-47575. The vulnerability is caused by missing authentication: a remote attacker may be able to send specially crafted requests to execute arbitrary code or commands on a vulnerable device. The NCSC described the exploitation as involving an automated script that exfiltrated files from vulnerable FortiManager devices.
The reported files contained IP addresses, credentials, and configurations for devices managed through FortiManager. That creates a risk beyond the management appliance itself: exposed credentials or configuration details may give an attacker information useful for targeting managed infrastructure. The cited public alerts do not name a confirmed threat actor or provide a victim count.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhich Fortinet products and versions may be affected?
The NCSC identifies FortiManager, FortiManager Cloud, and older FortiAnalyzer models with the FortiManager feature enabled as potentially affected. Singapore’s Cyber Security Agency (CSA) listed these FortiManager versions in its alert of 24 October 2024:
#1 Best Overall
- Protects against known exploits, malware and malicious websites; detects unknown attacks; identify thousands of applications
| Product | Versions listed as affected by Singapore CSA on 24 October 2024 |
|---|---|
| FortiManager | 7.6.0; 7.4.0 through 7.4.4; 7.2.0 through 7.2.7; 7.0.0 through 7.0.12; 6.4.0 through 6.4.14; and 6.2.0 through 6.2.12 |
| FortiManager Cloud | Listed in the CSA alert; consult Fortinet’s current advisory for the precise affected releases and remediation |
| FortiAnalyzer | Older models with the FortiManager feature enabled are identified by the NCSC as potentially affected; consult Fortinet’s current advisory for exact applicability |
These are historical ranges from the 24 October 2024 CSA alert, not a substitute for current release guidance. Product coverage and fixes depend on release branch and configuration. Check Fortinet’s live FG-IR-24-423 advisory using the exact product, version, and enabled features in your environment.
How severe is CVE-2024-47575?
The Singapore CSA assigned CVE-2024-47575 a CVSSv3.1 score of 9.8 out of 10 in its 24 October 2024 alert, placing it in the critical severity range. On 30 October 2024, CISA said Fortinet had updated its advisory with additional workarounds and indicators of compromise (IOCs), and that patches had been released. CISA also noted that it had previously added the vulnerability to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Those statements describe the status reported in October 2024; administrators should use Fortinet’s current advisory for present patch and mitigation instructions.
Quick Recap
Best Value
- Fortinet FortiMail-VM virtual appliance for all supported platforms. 2 x vCPU cores
- Fortinet SW FML-VM02
- Manufacturer Part: FML-VM02
Rank #4
- Fortinet FortiMail-VM virtual appliance for all supported platforms. 1 x vCPU cores
- Fortinet SW FML-VM01
- Manufacturer Part: FML-VM01
What should FortiManager administrators do?
- Confirm exposure. Identify each FortiManager, FortiManager Cloud, and FortiAnalyzer deployment, record its exact version and configuration, and compare them with Fortinet’s current FG-IR-24-423 advisory. Include older FortiAnalyzer models where the FortiManager feature is enabled.
- Assess for compromise. Review the latest vendor IOCs and perform threat hunting and monitoring for signs of unauthorized access or file exfiltration. The NCSC points administrators to the vendor advisory and related Google threat analysis for detection support. Singapore CSA’s 2024 alert included example suspicious log entries, IP addresses, a serial number, and temporary-file paths; validate any indicators against Fortinet’s current notice before using them in detection rules.
- Apply the correct update or mitigation. Install the security update specified for the exact product and release branch. If an update for that version is not available, follow the temporary mitigations in the current vendor advisory and check back for updated guidance.
- If compromise is suspected, recover as an incident. Follow Fortinet’s recovery instructions, including rebuilding or reinitialising the device as specified, changing credentials and other sensitive data that may have been exposed, and then installing the latest applicable version. Routine patching alone is not an adequate response when attacker access or credential exposure is suspected.
- Report through the appropriate national channel. The NCSC advises UK organisations to report suspected compromise to the NCSC. Singapore CSA directs organisations with listed indicators to report to SingCERT. Follow the reporting process for your jurisdiction.
Sources and dated guidance
- UK National Cyber Security Centre, “Exploitation of vulnerability affecting Fortinet FortiManager,” 24 October 2024
- Cyber Security Agency of Singapore, “Active Exploitation of a Critical Vulnerability in FortiManager,” 24 October 2024
- CISA, “Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation,” 30 October 2024
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
