TL;DR
- Fortinet disclosed a zero-day vulnerability to its customers as of October 23, that CISA and AttackerKB have identified as already exploited in the wild
- The vulnerability targets FortiManager, Fortinet’s platform for managing deployments of firewalls
- The patch should be applied immediately, and if that’s not possible, be sure that the protocol isn’t exposed to the internet
What happened?
Fortinet disclosed a zero-day vulnerability—CVE-2024-47575—on October 23. This vulnerability affects FortiManager, Fortinet’s platform for managing deployments of FortiGate firewalls. CISA and AttackerKB have already identified the vulnerability as actively exploited in the wild. Mandiant observed the vulnerability as early as June of this year.
Why does it matter?
The vulnerability allows an unauthenticated attacker to arbitrarily execute commands on Fortinet firewall devices via FortiManager. Based on our understanding of the vulnerability, it’s used to add additional malicious devices to FortiManager for persistence, and access to a victim’s network. If you’re investigating for exploitation, you should be looking for unexpected devices added to FortiManager.
What should you do right now?
For Fortinet customers, the vulnerability exists in the call home protocol, which is used to manage the devices connected to FortiManager. This protocol is known as FortiGate to FortiManager (FGFM). A patch has recently been released for the vulnerability. However, if the patch can’t be applied, your organization should ensure that the protocol isn’t exposed to the internet. This can be disabled with the following commands:
config system global
set fgfm-deny-unknown enable
end
What next?
We’re keeping a close eye on this situation as it unfolds. We’ll update this post with big developments, but keep an eye on our socials (@ExpelSecurity) for additional recommendations as they emerge.
If you or your team have any additional questions regarding this vulnerability, and information regarding signs of exploitation, please reach out to us.
Frequently asked questions
What is CVE-2024-47575?
A zero-day vulnerability in FortiManager that allows an unauthenticated attacker to arbitrarily execute commands on Fortinet firewall devices, disclosed by Fortinet on October 23, 2024, and already identified as actively exploited in the wild.
What is FortiManager?
FortiManager is Fortinet’s platform for centrally managing deployments of FortiGate firewalls.
What is the FGFM protocol?
FGFM (FortiGate to FortiManager) is the “call home” protocol FortiManager uses to communicate with and manage connected devices — and the protocol where CVE-2024-47575 exists.
How do I mitigate this vulnerability if I can’t patch immediately?
Ensure the FGFM protocol isn’t exposed to the internet. This can be disabled with the commands: config system global, set fgfm-deny-unknown enable, end.
What should I look for if I suspect exploitation?
Unexpected devices added to FortiManager — the vulnerability is used to add malicious devices for persistence and access to a victim’s network.
