An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
In September 2024, a sophisticated multi-stage intrusion targeted a telecommunications organization by exploiting CVE-2024-47575 on a FortiManager appliance to exfiltrate configurations and cryptographic material for over 500 FortiGate firewalls. Subsequently, attackers exploited CVE-2025-61624 to deploy PEERSTITCH, a novel ARM64 memory-resident malware implant that avoids disk and network detection. The implant patches running processes, creates covert inter-process communication channels, and intercepts network traffic. Additional attack techniques included using Apache mod_md for reverse shell command and control, impersonating FortiManager to compromise downstream devices, and employing extensive anti-forensic measures. The attack demonstrates advanced tradecraft consistent with nation-state actors and highlights the critical risk of centralized edge management platforms.