{"id":"CVE-2024-47575","kind":"vulnerability","aliases":["CVE-2024-47575"],"related":[],"title":"A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager…","description":"A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.","summary":"Fortinet FortiManager has a missing authentication flaw in its fgfmd daemon, which handles connections from managed FortiGate devices. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the FortiManager.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-10-23T00:00:00+00:00","products":[{"name":"fortinet fortimanager","fixed":["6.2.13"],"affected":">= 6.2.0, < 6.2.13","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["6.4.15"],"affected":">= 6.4.0, < 6.4.15","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["7.0.13"],"affected":">= 7.0.0, < 7.0.13","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["7.2.8"],"affected":">= 7.2.0, < 7.2.8","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["7.4.5"],"affected":">= 7.4.0, < 7.4.5","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":[],"affected":"= 7.6.0","ecosystem":"vendor"},{"name":"fortinet fortimanager cloud","fixed":[],"affected":">= 6.4.1, <= 6.4.7","ecosystem":"vendor"},{"name":"fortinet fortimanager cloud","fixed":["7.0.13"],"affected":">= 7.0.1, < 7.0.13","ecosystem":"vendor"},{"name":"fortinet fortimanager cloud","fixed":["7.2.8"],"affected":">= 7.2.1, < 7.2.8","ecosystem":"vendor"},{"name":"fortinet fortimanager cloud","fixed":["7.4.5"],"affected":">= 7.4.1, < 7.4.5","ecosystem":"vendor"},{"name":"Fortinet FortiManager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortimanager","fortinet","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigation or fixed firmware per Fortinet's vendor advisory; the sources do not name the fixed version. Discontinue use if no mitigation is available, per CISA.","status":"open","published_at":"2024-10-23T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:23+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or fixed firmware per Fortinet's vendor advisory; the sources do not name the fixed version. Discontinue use if no mitigation is available, per CISA.","reach":"network","impact":"high","summary":"Fortinet FortiManager has a missing authentication flaw in its fgfmd daemon, which handles connections from managed FortiGate devices. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the FortiManager.","category":"infrastructure","who_cares":["fortimanager","fortinet","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code and commands on FortiManager.","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2024-47575 to get affected and fixed versions, the mitigation steps, and any exposure check (fgfmd port reachability, IOC logs).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":2834,"output_tokens":408,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':16A,19A '-47575':17A,20A '6.2.0':115C '6.2.12':117C '6.4.0':111C '6.4.1':136C '6.4.14':113C '6.4.7':138C '7.0.0':107C '7.0.1':131C '7.0.12':109C,133C '7.2.0':103C '7.2.1':126C '7.2.7':105C,128C '7.4.0':11A,99C '7.4.1':121C '7.4.4':13A,101C,123C '7.6.0':9A,97C 'allow':139C 'arbitrari':82B,143C 'attack':75B,140C 'authent':3A,59B,91C 'cloud':35A,38A,41A,44A,120C,125C,130C,135C 'code':83B,144C 'command':85B,146C 'connect':67B 'craft':78B,149C 'critic':5A,93C 'cve':15A,18A 'daemon':64B 'devic':71B 'execut':81B,142C 'exploit':47B 'fgfmd':63B 'flaw':60B 'fortig':70B 'fortimanag':8A,10A,14A,48B,55B,88B,96C,98C,102C,106C,110C,114C,119C,124C,129C,134C 'fortimanager':22A,24A,26A,28A,30A,32A,34A,37A,40A,43A,46A 'fortinet':21A,23A,25A,27A,29A,31A,33A,36A,39A,42A,45A,49B,54B,118C 'function':6A,94C 'handl':66B 'host':53B 'infrastructur':50B 'manag':69B 'miss':2A,58B,90C 'remot':73B 'request':79B,150C 'self':52B 'self-host':51B 'send':77B 'special':148C 'unauthent':74B 'via':147C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-23T00:00:00+00:00","kev":{"dateAdded":"2024-10-23","dueDate":"2024-11-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-47575","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-47575","severity":null,"published_at":"2024-10-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-47575","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47575","severity":null,"published_at":"2024-10-23T15:15:30+00:00","modified_at":"2026-06-17T07:57:20+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}