Fortinet FortiManager Under Attack: Critical CVE-2024-47575 Vulnerability

Shadowserver has issued a critical warning about the widespread exploitation of Fortinet FortiManager devices due to the recently disclosed CVE-2024-47575 vulnerability, termed “FortiJump.” This vulnerability, with a CVSS score of 9.8/10, allows unauthenticated remote attackers to execute arbitrary code on affected systems, targeting sensitive data exfiltration as their primary objective. The alert indicates a highly concerning situation for organizations relying on FortiManager, urging immediate remedial measures to mitigate potential security breaches.

Fortinet has confirmed the active exploitation of this vulnerability and has called for urgent action from all users of FortiManager systems. In a detailed Special Report, Shadowserver categorizes affected devices into two groups: those that have been compromised and those that have been targeted but not yet confirmed as compromised. It strongly emphasizes the necessity of changing credentials for all managed devices connected to the vulnerable FortiManager systems. This task is rendered more complex by the potential presence of multiple IP addresses and NAT device traversal, complicating the identification process.

The Attack and the Threat Actor

Mandiant has attributed these attacks to a threat actor known as UNC5820, bringing to light that the exploitation has been ongoing since at least June 27, 2024. According to Mandiant’s findings, more than 50 FortiManager appliances across a range of industries have been targeted in this mass compromise. This highlights the critical nature of the “FortiJump” vulnerability and the rapid, widespread exploitation by threat actors. The situation underscores the need for organizations to stay vigilant and apply necessary security measures without delay.

Organizations using FortiManager are urged to immediately apply patches provided by Fortinet or implement recommended workarounds if patching is not feasible. The directive from Shadowserver’s report highlights the importance of these measures in securing systems and curbing further exploits. As threat actors continue to capitalize on this vulnerability, cybersecurity experts stress the importance of monitoring for any indicators of compromise and reporting suspicious activities related to FortiManager deployments promptly.

Recommendations for Organizations

Shadowserver has issued an urgent warning regarding the widespread exploitation of Fortinet FortiManager devices, linked to the recently disclosed CVE-2024-47575 vulnerability known as “FortiJump.” This vulnerability, boasting a CVSS score of 9.8 out of 10, enables unauthenticated remote attackers to execute arbitrary code on the affected systems, primarily aiming to exfiltrate sensitive data. The alert underscores a highly alarming situation for organizations relying on FortiManager, urging them to take swift remedial measures to prevent potential security breaches.

Fortinet has acknowledged the active exploitation of this flaw and is calling for immediate action from all FortiManager users. In a comprehensive Special Report, Shadowserver categorizes affected devices into two groups: those compromised and those targeted but not yet confirmed as compromised. It strongly emphasizes the critical need to change credentials for all managed devices connected to vulnerable FortiManager systems. This task is further complicated by the potential presence of multiple IP addresses and the traversal of NAT devices, making identification more challenging.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative