Fortinet FortiOS / FortiManager 2024 Zero-Days
Was ist Fortinet FortiOS / FortiManager 2024 Zero-Days?
Fortinet FortiOS / FortiManager 2024 Zero-DaysA 2024 series of pre-authentication vulnerabilities in Fortinet FortiOS, FortiProxy, FortiManager and the FortiGate SSL-VPN — including the FortiManager fgfmd flaw CVE-2024-47575 ('FortiJump') — exploited as zero-days by Chinese state-aligned actors.
Throughout 2024 Fortinet products were repeatedly targeted with pre-authentication zero-day vulnerabilities, especially in the FortiGate SSL-VPN service and in FortiManager's fgfmd protocol. The headline issue, CVE-2024-47575 ('FortiJump', disclosed October 2024, CVSS 9.8), is a missing-authentication flaw in FortiManager's fgfmd device-registration channel that lets an unauthenticated remote attacker register a malicious FortiGate, execute commands on the FortiManager, and pivot to manage every connected device. Mandiant attributed exploitation to UNC5820 (a China-nexus cluster) and observed compromise of dozens of FortiManagers before the patch and even some after. Other 2024 cases include CVE-2024-21762 (FortiOS SSL-VPN out-of-bound write, CVSS 9.6), CVE-2024-23113 (fgfmd format-string, CVSS 9.8), CVE-2024-55591 (Node.js websocket auth bypass in FortiOS), and CVE-2024-50603 (Aviatrix-style command injection). All were added to the CISA KEV catalog. The pattern reinforced that internet-exposed network-edge appliances remain a primary initial-access surface, especially for state-aligned actors building VPN-mediated footholds.
● Beispiele
- 01
An MSSP's internet-exposed FortiManager is compromised via CVE-2024-47575 before its operator gets to patch; UNC5820 pushes config changes to dozens of customer FortiGates.
- 02
An enterprise enforces a 'no FortiGate management interface on the public internet' policy and configures FortiManager fgfmd to whitelist device certs after the FortiJump advisory.
● Häufige Fragen
Was ist Fortinet FortiOS / FortiManager 2024 Zero-Days?
A 2024 series of pre-authentication vulnerabilities in Fortinet FortiOS, FortiProxy, FortiManager and the FortiGate SSL-VPN — including the FortiManager fgfmd flaw CVE-2024-47575 ('FortiJump') — exploited as zero-days by Chinese state-aligned actors. Es gehört zur Kategorie Schwachstellen der Cybersicherheit.
Was bedeutet Fortinet FortiOS / FortiManager 2024 Zero-Days?
A 2024 series of pre-authentication vulnerabilities in Fortinet FortiOS, FortiProxy, FortiManager and the FortiGate SSL-VPN — including the FortiManager fgfmd flaw CVE-2024-47575 ('FortiJump') — exploited as zero-days by Chinese state-aligned actors.
Wie funktioniert Fortinet FortiOS / FortiManager 2024 Zero-Days?
Throughout 2024 Fortinet products were repeatedly targeted with pre-authentication zero-day vulnerabilities, especially in the FortiGate SSL-VPN service and in FortiManager's fgfmd protocol. The headline issue, CVE-2024-47575 ('FortiJump', disclosed October 2024, CVSS 9.8), is a missing-authentication flaw in FortiManager's fgfmd device-registration channel that lets an unauthenticated remote attacker register a malicious FortiGate, execute commands on the FortiManager, and pivot to manage every connected device. Mandiant attributed exploitation to UNC5820 (a China-nexus cluster) and observed compromise of dozens of FortiManagers before the patch and even some after. Other 2024 cases include CVE-2024-21762 (FortiOS SSL-VPN out-of-bound write, CVSS 9.6), CVE-2024-23113 (fgfmd format-string, CVSS 9.8), CVE-2024-55591 (Node.js websocket auth bypass in FortiOS), and CVE-2024-50603 (Aviatrix-style command injection). All were added to the CISA KEV catalog. The pattern reinforced that internet-exposed network-edge appliances remain a primary initial-access surface, especially for state-aligned actors building VPN-mediated footholds.
Wie schützt man sich gegen Fortinet FortiOS / FortiManager 2024 Zero-Days?
Schutzmaßnahmen gegen Fortinet FortiOS / FortiManager 2024 Zero-Days kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für Fortinet FortiOS / FortiManager 2024 Zero-Days?
Übliche alternative Bezeichnungen: FortiJump, CVE-2024-47575, CVE-2024-21762.
● Verwandte Begriffe
- vulnerabilities№ 1399
Zero-Day-Schwachstelle
Eine Sicherheitslücke, die dem Hersteller zum Zeitpunkt ihrer Entdeckung oder Ausnutzung unbekannt ist oder für die noch kein Patch existiert.
- vulnerabilities№ 194
CISA Known Exploited Vulnerabilities (KEV) Catalog
A U.S. CISA-maintained list of CVEs with credible evidence of in-the-wild exploitation, paired with mandatory remediation deadlines for U.S. federal civilian agencies and widely used by enterprises as a priority signal.
- network-security№ 1339
VPN (Virtual Private Network)
Eine Technologie, die einen verschlüsselten, authentifizierten Tunnel über ein öffentliches Netz aufbaut, sodass der Verkehr scheinbar über ein privates Netz läuft.
- network-security№ 1210
SSL-VPN
Ein VPN, das den Tunnel über TLS (historisch SSL) führt und Remote-Zugriff über Standard-Web-Ports ohne dediziertes VPN-Protokoll ermöglicht.
- attacks№ 1234
Supply-Chain-Angriff
Angriff, der einen vertrauenswürdigen Software-, Hardware- oder Dienstleister kompromittiert, um dessen nachgelagerte Kunden zu erreichen.
- defense-ops№ 799
Staatlicher Akteur
Vom Staat gefoerderter oder mit ihm verbundener Bedrohungsakteur, der Cyberoperationen zu strategischen, nachrichtendienstlichen, militaerischen oder wirtschaftlichen Zwecken durchfuehrt.