CVE-2024-47575—Fortinet FortiManager Missing Authentication Vulnerability

Vulnerability Name

Fortinet FortiManager Missing Authentication Vulnerability

Description

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://fortiguard.fortinet.com/psirt/FG-IR-24-423
• https://nvd.nist.gov/vuln/detail/CVE-2024-47575

Related News Articles

• Critical FortiSwitch flaw lets hackers change admin passwords remotelyApril 9, 2025
• Fortinet warns of auth bypass zero-day exploited to hijack firewallsJanuary 14, 2025
• Mandiant says new Fortinet flaw has been exploited since JuneOctober 24, 2024
• Fortinet Warns of Critical Vulnerability in FortiManager Under Active ExploitationOctober 24, 2024

Related Weaknesses

• CWE-306