CVE-2024-47575

What it actually does

CVE-2024-47575 is a critical missing-authentication vulnerability in Fortinet FortiManager and FortiManager Cloud that affects the FortiGate-to-FortiManager management channel. An unauthenticated remote attacker can send specially crafted requests to the FortiManager service and cause the appliance to execute arbitrary commands or code without first proving they are an authorized managed device or administrator. Because FortiManager centrally stores and manages FortiGate configuration, successful exploitation can expose firewall policies, credentials or secrets present in configuration data, device inventories, and management workflows, and may allow further compromise of managed security infrastructure.

Why it matters to the business

Compromise of FortiManager can undermine centralized firewall management, exposing network security configurations and potentially allowing attackers to pivot toward managed FortiGate devices or alter security controls. The vulnerability is known to be exploited in the wild, has a very high EPSS score of 0.9495, and is listed in CISA KEV with a remediation due date of 2024-11-13, so unpatched internet-reachable or untrusted-network-reachable FortiManager instances should be treated as high-priority exposure. Operational consequences can include loss of trust in firewall policy integrity, theft of sensitive network configuration data, emergency change freezes, forced credential rotation, incident response activity, and possible disruption to security administration.

How an attack unfolds

An attacker first identifies a FortiManager or FortiManager Cloud instance with the FortiManager management service reachable, commonly over the FortiGate management protocol on TCP/541. The attacker then sends crafted protocol requests that exploit the missing authentication check for a critical management function. Because the vulnerable service fails to properly verify that the requester is an authorized managed device or trusted administrator, the attacker can register or interact as an unauthorized device and issue actions that lead to arbitrary command or code execution. In real-world exploitation, activity associated with this flaw has included unauthorized device-management events and access to FortiManager-managed configuration data. From there, an attacker may harvest firewall configurations, identify high-value internal paths, obtain secrets embedded in configurations, stage persistence or tooling where possible, and use the FortiManager foothold to support broader compromise of the network security management plane.

How to fix it

Upgrade FortiManager and FortiManager Cloud to Fortinet fixed releases as directed by the vendor. Based on Fortinet's affected-version ranges, vulnerable branches include FortiManager 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, and 6.2.0 through 6.2.12, as well as FortiManager Cloud 7.4.1 through 7.4.4, 7.2.1 through 7.2.7, 7.0.1 through 7.0.12, and 6.4.1 through 6.4.7. Upgrade to the vendor-designated fixed version for the deployed branch, such as FortiManager 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, 6.4.15 or later, and 6.2.13 or later where applicable. If immediate patching is not possible, restrict FortiManager management access to trusted FortiGate device IP addresses and administrative networks only, block TCP/541 from the internet and untrusted networks, apply local-in firewall policies or upstream ACLs, and enable Fortinet-recommended controls such as denying unknown FortiGate devices from registering with FortiManager where supported. Treat mitigations as temporary because the vulnerability is actively exploited.

How to confirm the fix worked

Confirm the running FortiManager or FortiManager Cloud version is no longer in an affected range and matches a Fortinet fixed release for its branch. Verify that TCP/541 and any FortiManager administrative interfaces are not reachable from the public internet or unauthorized network segments. Review FortiManager settings to ensure unknown device registration is denied where supported and that only expected FortiGate serial numbers and source IP addresses can communicate with the manager. Validate network controls with an external and internal port scan from untrusted segments. Review the managed-device inventory for unknown, duplicate, recently added, or suspicious devices, including devices named localhost or devices with unexpected serial numbers. Confirm event logs no longer show unauthorized device-add operations after patching or mitigation. If exploitation is suspected, rebuild or restore FortiManager from a trusted state, rotate credentials and secrets stored in managed configurations, and validate managed FortiGate configuration integrity.

Typical attack path

1. Scan for FortiManager or FortiManager Cloud instances exposing the FortiManager management service, especially TCP/541, to the internet or untrusted networks.
2. Fingerprint the target version or behavior to determine whether it falls within the vulnerable FortiManager 6.2, 6.4, 7.0, 7.2, 7.4, or 7.6 release ranges.
3. Send specially crafted FortiManager management protocol requests that reach the vulnerable critical function without valid authentication.
4. Abuse the missing authentication check to interact as an unauthorized managed device or otherwise trigger arbitrary command/code execution paths.
5. Collect FortiManager data such as managed-device inventory, firewall configuration, policy objects, VPN settings, routing details, and credentials or secrets stored in configuration.
6. Modify configuration, deploy additional commands, create or alter management artifacts, or use the appliance as a staging point depending on privileges achieved.
7. Attempt lateral movement or follow-on compromise against managed FortiGate devices and adjacent administrative systems.

How to detect it

To determine whether exploitation already occurred, review FortiManager event logs, device-manager logs, system logs, administrative audit logs, configuration revision history, and network telemetry for the period before and after patching. Focus on unauthorized or unexpected device-add events, especially unregistered devices, devices named localhost, unknown serial numbers, or device additions from unfamiliar source IP addresses. Search for connections to the FortiManager management protocol, commonly TCP/541, from internet addresses, VPN pools, workstations, or any network ranges that should not contain managed FortiGate devices. Examine administrator accounts, API users, automation scripts, CLI scripts, scheduled tasks, and install history for entries created or modified around suspicious device-registration events. Review managed FortiGate configurations for unauthorized changes, newly added local users, altered VPN settings, modified firewall policies, changed routing, new address objects, or changed logging destinations. If logs show unknown-device registration or suspicious FGFM traffic, assume configuration data may have been exposed and investigate for credential use from the same source infrastructure across VPN, firewall, identity, and management systems. Because this vulnerability has been actively exploited in the wild, absence of obvious command-execution artifacts is not sufficient; prioritize correlation of FortiManager device-management events with network flows and configuration-access activity.

• TCP/541
• fgfmd
• FGFM
• Unregistered device
• Unregistered device localhost add succeeded
• localhost add succeeded
• Add device
• operation="Add device"
• performed_on="localhost"
• subtype=dvm
• type=event subtype=dvm
• desc="Device,Manager,Generic,Information,log"
• fgfm-deny-unknown
• unknown device
• unauthorized device
• device="localhost"

What your security team should do

• Immediately inventory all FortiManager and FortiManager Cloud deployments and identify any versions in the affected ranges.
• Patch or upgrade exposed FortiManager systems as the top priority; the vulnerability is in CISA KEV, actively exploited, and the KEV due date has passed.
• Block TCP/541 and FortiManager administrative access from the internet and all untrusted networks; allow only explicitly trusted FortiGate device IPs and administrative jump networks.
• Enable controls that deny unknown FortiGate device registration where supported, and audit the authorized managed-device list for unexpected entries.
• Hunt FortiManager event, device-manager, audit, and system logs for unauthorized device additions, especially messages involving unregistered devices or localhost.
• Review FortiManager configuration databases, scripts, administrator accounts, API users, automation hooks, and scheduled tasks for unauthorized changes.
• Assume configuration data may have been accessed if suspicious device-registration activity is found; rotate passwords, VPN secrets, API tokens, SNMP communities, and other secrets stored in managed firewall configurations.
• Correlate FortiManager logs with firewall, VPN, identity, EDR, and network telemetry to identify follow-on activity from the same source IPs or time windows.
• Preserve forensic evidence before remediation where compromise is suspected, including logs, configuration backups, memory or disk images if feasible, and network flow records.
• After remediation, continuously monitor for new connections to TCP/541, unexpected FGFM activity, and unauthorized device-management events.