Missing Authentication Vulnerability in Fortinet FortiManager (CVE‑2024‑47575) Enables Remote Code Execution
What It Is — Fortinet FortiManager’s fgfmd daemon lacks proper authentication, allowing an unauthenticated remote attacker to send specially‑crafted requests that trigger arbitrary command execution.
Exploitability — The flaw is exploitable over the network without credentials; a proof‑of‑concept exists in public advisories. No confirmed active exploit reports yet, but the attack surface is broad.
Affected Products — All FortiManager deployments (on‑premise or virtual) that have not applied the vendor‑released patch for CVE‑2024‑47575.
Why It Matters for Trust & Control Assurance
- Authentication controls – The vulnerability directly tests the effectiveness of your access‑control policies and the evidence you retain that only authorized entities can invoke privileged services.
- Continuous monitoring – Detecting anomalous
fgfmdtraffic or unexpected command execution requires log collection, correlation, and alerting that can be demonstrated in an audit. - Defensible audit trail – Remediating and documenting the patch rollout provides concrete proof of due‑diligence for frameworks that map to the “Identity & Access Management” control objective.
Recommended Actions
- Deploy Fortinet’s patch for CVE‑2024‑47575 immediately.
- Verify that the
fgfmddaemon now enforces authentication by testing with unauthenticated requests. - Enable detailed logging for FortiManager management interfaces and integrate logs into a SIEM for real‑time detection of suspicious calls.
- Update your access‑control inventory and capture evidence of the remediation for audit readiness.
Source: CISA KEV – CVE‑2024‑47575