Fortinet disclosed active zero-day exploitation of CVE-2024-47575 (CVSS 9.8), a critical missing-authentication vulnerability in the FortiGate to FortiManager (FGFM) protocol daemon fgfmd listening on TCP port 541. The flaw allows remote unauthenticated actors to establish arbitrary FGFM sessions using valid factory certificates extracted from any Fortinet appliance. Because fgfmd fails to verify whether incoming connections originate from registered or authorized managed devices, attackers can transmit crafted FGFM payloads directly into internal routines—such as the som/export channel—to invoke arbitrary system() commands with root privileges.

Tracked by Mandiant as UNC5820, threat actors weaponized the zero-day since at least June 2024 to breach over 50 enterprise FortiManager systems, exfiltrating configuration files, network topologies, user credentials, and password hashes across downstream FortiGate fleets. Fortinet issued security advisory FG-IR-24-423, releasing patches in FortiManager versions 7.6.1, 7.4.5, 7.2.8, and 7.0.13. For unpatched deployments, Fortinet urges administrators to enable set fgfm-deny-unknown enable, restrict port 541 ingress via local-in allowlists, and enforce custom CA device certificates. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated root execution on centralized management appliances collapses downstream network isolation, allowing adversaries to harvest configuration secrets and turn network control planes into lateral pivoting footholds across all managed edge firewalls.
• Bullet 2 — Strategic & Defender Imperative: Security teams must immediately apply vendor firmware updates, block external exposure of FGFM port 541, reject unknown device enrollments via CLI configurations, and rotate all administrative credentials and VPN preshared keys managed by affected instances.