CVE-2024-47575

The attacker sends specially crafted network requests to the vulnerable FortiManager system without needing any authentication credentials. A critical system function is accessible without identity verification, which is a missing authentication vulnerability (CWE-306). This allows arbitrary code or system commands to be executed on the management server.

An unauthenticated remote attacker can gain full control over the FortiManager system by executing arbitrary code or system commands, which may lead to compromise of managed network infrastructure, theft of configuration data, and lateral movement within the network.

Security patches available from the vendor must be applied immediately according to references published by Fortinet (FG-IR-24-423 on fortiguard.fortinet.com). Until the patch is deployed, it is recommended to restrict network access to the FortiManager management interface to trusted IP addresses only and to monitor the system for suspicious activity.

FortiManager 7.6.0; FortiManager 7.4.0–7.4.4; FortiManager 7.2.0–7.2.7; FortiManager 7.0.0–7.0.12; FortiManager 6.4.0–6.4.14; FortiManager 6.2.0–6.2.12; FortiManager Cloud 7.4.1–7.4.4; FortiManager Cloud 7.2.1–7.2.7; FortiManager Cloud 7.0.1–7.0.12; FortiManager Cloud 6.4.1–6.4.7

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.