CVE-2024-47575 Explained: Fortinet FortiManager Missing Authentication — FortiJump

FortiManager uses a proprietary protocol called FGFM (FortiGate to FortiManager) on TCP port 541 to communicate with and manage FortiGate firewall devices. This protocol handles device registration, configuration push, log collection, and management communication between FortiGate devices in the field and the central FortiManager server.

The vulnerability is classified as CWE-306 — Missing Authentication for Critical Function. The FGFM daemon exposes certain functionality without enforcing authentication checks. An attacker who can reach TCP port 541 on the FortiManager server can send specially crafted FGFM protocol messages that exploit this missing authentication to execute arbitrary commands on the server without presenting any valid credential.

Because the FGFM port is intentionally accessible from managed FortiGate devices — which may be deployed across customer sites or remote locations — it is often reachable from the internet on FortiManager deployments used by MSPs or enterprises with distributed infrastructure.

Mandiant's analysis of the UNC5820 FortiJump campaign revealed a threat actor with clear strategic objectives: intelligence collection about network security infrastructure and acquisition of credentials enabling persistent access to managed networks.

UNC5820's post-exploitation activity focused on: enumerating the FortiManager-managed device inventory to understand what networks and organisations were being managed, exfiltrating FortiOS configuration files for all reachable managed devices, extracting credentials and private keys from the exfiltrated configurations, and creating additional administrative objects within FortiManager for potential future access.

The targeting of MSP FortiManager instances is particularly significant. An MSP managing 50 enterprise customers via a single FortiManager deployment represents 50 simultaneous targets — their network configurations, VPN credentials, and firewall rules all exposed by a single FortiManager compromise. This is the same MSP targeting logic seen in ConnectWise ScreenConnect (CVE-2024-1709) and Kaseya VSA (CVE-2021-30116) exploitation.

Patch to a fixed FortiManager version. The FGFM port restriction workaround reduces but does not eliminate exposure for specific scenarios.

CVE-2024-47575 follows the same strategic logic as the Ivanti Connect Secure zero-day and the ConnectWise ScreenConnect vulnerability: compromise the management platform, access everything it manages. For FortiManager, 'everything it manages' means the complete security infrastructure of every customer or site under management — a single FortiManager compromise can be strategically equivalent to compromising every managed FortiGate.

MSPs using FortiManager to manage customer environments should treat this as a potential breach of their customer environments, not just a breach of their own infrastructure. The credential and configuration exfiltration documented by Mandiant provides attackers with the means to access any VPN endpoint, management interface, or internal service accessible through the managed FortiGate devices.