CVEvulnerability

CVE-2024-47575

9.8 CRITICAL Known exploited Published 2024-10-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Fortinet FortiManager Missing Authentication Vulnerability — Fortinet FortiManager

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Added to KEV: 2024-10-23
Remediation due: 2024-11-13
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-24-423 ; https://nvd.nist.gov/vuln/detail/CVE-2024-47575

Status: Analyzed
Published: 2024-10-23
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-306

Description

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Affected configurations

• fortinet fortimanager (>= 6.2.0 < 6.2.13) • fortinet fortimanager (>= 6.4.0 < 6.4.15) • fortinet fortimanager (>= 7.0.0 < 7.0.13) • fortinet fortimanager (>= 7.2.0 < 7.2.8) • fortinet fortimanager (>= 7.4.0 < 7.4.5) • fortinet fortimanager 7.6.0 • fortinet fortimanager cloud (>= 6.4.1 <= 6.4.7) • fortinet fortimanager cloud (>= 7.0.1 < 7.0.13) • fortinet fortimanager cloud (>= 7.2.1 < 7.2.8) • fortinet fortimanager cloud (>= 7.4.1 < 7.4.5)

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References