Actively exploited · Published Oct 23, 2024 · Assigned by fortinet
CVE-2024-47575
Critical 9.8 Exploited
In plain English
A critical-severity missing authentication in FortiManager from Fortinet. Attackers are actively exploiting it in the wild (listed by CISA on October 23, 2024). The chance it is exploited in the next 30 days is estimated at 94.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 13, 2024.
Official description
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiManager | 7.6.07.4.0 – through 7.4.47.2.0 – through 7.2.77.0.0 – through 7.0.126.4.0 – through 6.4.146.2.0 – through 6.2.12 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C