CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2024-47575

CVSS 9.8v3.1pub. 2024-10-23upd. 2025-10-24

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fortinet Fortimanager
APP
Fortinet
7.6.06.4.0 – 6.4.15 (bez)7.0.0 – 7.0.13 (bez)7.2.0 – 7.2.8 (bez)7.4.0 – 7.4.5 (bez)6.2.0 – 6.2.13 (bez)
Fortinet Fortimanager Cloud
APP
Fortinet
6.4.1 – 6.4.77.0.1 – 7.0.13 (bez)7.2.1 – 7.2.8 (bez)7.4.1 – 7.4.5 (bez)

CISA KEV — detailsi

Vendori: Fortinet ↗
Producti: FortiManager
Added to KEVi: October 23, 2024
Remediation deadline (US Federal)i: November 13, 2024(overdue)

🔧Advisory Fortinet↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

🔴