Fortinet exploited zero-day: FG-IR-24-423 Missing authentication in fgfmsd
CVE-2024-47575 (9.8 critical, disclosed 23 October by Fortinet, noted earlier on 13 October by @GossiTheDog on Mastodon) Fortinet FortiManager Missing Authentication Vulnerability.

• Reports have shown this vulnerability to be exploited in the wild.
• The identified actions of this attack in the wild have been to automate via a script the exfiltration of various files from the FortiManager which contained the IPs, credentials and configurations of the managed devices.

CISA added CVE-2024-47575 to the KEV Catalog about 3 hours afterward.

Just in case you didn't read closely, there are indicators of compromise (IoC) in the advisory. At least one of the IP addresses was reportedly used as a Cobalt Strike server 2 years ago.

cc: @cR0w @nopatience I require at least 25 favorites to unlock my next toot!

#fortinet #fortimanager #cve #zeroday #CVE_2024_47575 #vulnerability #eitw #activeexploitation #kev #cisakev #KnownExploitedVulnerabilitiesCatalog

❗️ #CERTWarnung ❗️
In #FortiManager von Fortinet wurde eine Zero-Day #Schwachstelle geschlossen, die seit Juni ausgenutzt wird. Eine Kompromittierung ist zu prüfen. Kunden sollten unverzüglich ihre Geräte absichern. #PatchNow

On the #fortinet #fortimanager vulnerability (CVE-2024-47575), one remediation step is to set disallow new Fortigates from registering automatically, the default setting. Be aware, if you don't have a #Fortigate in the device list already registered, you will not be able to add it even with a cert. To ensure all of your firewalls are in the device list in FortiManager:

diag dvm device list.

There are other remediations you can do, but if you use this one, look at your device list first.

Patch your FortiManager now. Limit access to it to only from dedicated jump-servers.