Red Hot Cyber
Cybersecurity is about sharing.
Recognize the risk, combat it, share your experiences,
and encourage others to do better than you.
Redazione RHC : 24 October 2024 08:56
Recently, Fortinet disclosed a critical vulnerability, identified as CVE-2024-47575, affecting FortiManager.
This is a missing authentication vulnerability for critical functions [CWE-306] in the FortiManager fgfmd daemon, which could allow an unauthenticated remote attacker to execute arbitrary code or commands via specially crafted requests.
With a CVSS score of 9.8, this flaw poses a significant threat to organisations using these systems.
| Version | Affected | Solution |
|---|---|---|
| FortiManager 7.6 | 7.6.0 | Upgrade to 7.6.1 or above |
| FortiManager 7.4 | 7.4.0 through 7.4.4 | Upgrade to 7.4.5 or above |
| FortiManager 7.2 | 7.2.0 through 7.2.7 | Upgrade to 7.2.8 or above |
| FortiManager 7.0 | 7.0.0 through 7.0.12 | Upgrade to 7.0.13 or above |
| FortiManager 6.4 | 6.4.0 through 6.4.14 | Upgrade to 6.4.15 or above |
| FortiManager 6.2 | 6.2.0 through 6.2.12 | Upgrade to 6.2.13 or above |
| FortiManager Cloud 7.6 | Not affected | Not Applicable |
| FortiManager Cloud 7.4 | 7.4.1 through 7.4.4 | Upgrade to 7.4.5 or above |
| FortiManager Cloud 7.2 | 7.2.1 through 7.2.7 | Upgrade to 7.2.8 or above |
| FortiManager Cloud 7.0 | 7.0.1 through 7.0.12 | Upgrade to 7.0.13 or above |
| FortiManager Cloud 6.4 | 6.4 all versions | Migrate to a fixed release |
Iscriviti GRATIS alla RHC Conference 2025 (Venerdì 9 maggio 2025)
Il giorno Venerdì 9 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terrà
la RHC Conference 2025. Si tratta dell’appuntamento annuale gratuito, creato dalla community di RHC, per far accrescere l’interesse verso le tecnologie digitali, l’innovazione digitale e la consapevolezza del rischio informatico.
La giornata inizierà alle 9:30 (con accoglienza dalle 9:00) e sarà interamente dedicata alla RHC Conference, un evento di spicco nel campo della sicurezza informatica. Il programma prevede un panel con ospiti istituzionali che si terrà all’inizio della conferenza. Successivamente, numerosi interventi di esperti nazionali nel campo della sicurezza informatica si susseguiranno sul palco fino alle ore 19:00 circa, quando termineranno le sessioni. Prima del termine della conferenza, ci sarà la premiazione dei vincitori della Capture The Flag prevista per le ore 18:00.
Potete iscrivervi gratuitamente all'evento utilizzando questo link.
Per ulteriori informazioni, scrivi a [email protected] oppure su Whatsapp al 379 163 8765
Supporta RHC attraverso:
Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.
According to the Fortinet bulletin, this vulnerability appears to have been actively exploited by malicious actors. The Fortinet bulletin also contains specific IoC compromise indicators.
Fortinet has released security updates to mitigate this vulnerability. Users are strongly encouraged to upgrade to patched versions of FortiMamnager to reduce the risk of exploitation. Updates are critical not only to fix known vulnerabilities, but also to ensure continued protection against future threats.
In addition to updates, Fortinet recommends closely monitoring system logs as this flaw is under active exploitation. Careful analysis can help detect suspicious activity that could indicate an attempt to exploit the vulnerability.
It is crucial that companies understand the importance of keeping their systems up-to-date and taking proactive measures to prevent cyber attacks. Vulnerability management must be an integral part of any organisation’s cyber security strategy, considering the ever-changing threat landscape.
Finally, Fortinet has created a dedicated vulnerability page where users can find further details and useful resources. For more information, you can visit the FortiGuard website here.
Redazione