Search: CVE-2024-47575

CVE-2024-47575 is a critical missing authentication vulnerability in Fortinet FortiManager's fgfmd daemon. It allows remote, unauthenticated attackers to execute arbitrary code or commands via specially crafted requests. The vulnerability has a CVSS score of 9.8 and is known to be exploited in the wild.

In September 2024, a sophisticated multi-stage intrusion targeted a telecommunications organization by exploiting CVE-2024-47575 on a FortiManager appliance to exfiltrate configurations and cryptographic material for over 500 FortiGate firewalls. Subsequently, attackers exploited CVE-2025-61624 to deploy PEERSTITCH, a novel ARM64 memory-resident malware implant that avoids disk and network detection. The implant patches running processes, creates covert inter-process communication channels, and intercepts network traffic. Additional attack techniques included using Apache mod_md for reverse shell command and control, impersonating FortiManager to compromise downstream devices, and employing extensive anti-forensic measures. The attack demonstrates advanced tradecraft consistent with nation-state actors and highlights the critical risk of centralized edge management platforms.