CVE-2024-47575
CRITICAL KEV NUCLEIFortinet FortiManager <7.6.0 - RCE
Title source: llmDescription
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Exploits (12)
nomisec
WORKING POC
96 stars
by watchtowrlabs · remote
https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
nomisec
WORKING POC
1 stars
by SkyGodling · remote
https://github.com/SkyGodling/exploit-cve-2024-47575
metasploit
WORKING POC
EXCELLENT
by sfewer-r7 · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb
Nuclei Templates (1)
FortiManager Unauthenticated Remote Code Execution
CRITICALby 0x_Akoko,pussycat0x,watchTowr
Scores
CVSS v3
9.8
EPSS
0.9387
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CISA KEV
2024-10-23
VulnCheck KEV
2024-10-23
InTheWild.io
2024-10-23
ENISA EUVD
EUVD-2024-42531
CWE
CWE-306
Status
published
Products (3)
fortinet/fortimanager
7.6.0
fortinet/fortimanager
6.2.0 - 6.2.13
fortinet/fortimanager_cloud
6.4.1 - 6.4.7
Published
Oct 23, 2024
KEV Added
Oct 23, 2024
Tracked Since
Feb 18, 2026