Fortinet · FortiManager
CVE-2024-47575
Fortinet FortiManager Missing Authentication Vulnerability
概要
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
CISA: Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
対処法
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2024年11月13日
Fortinetのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/10/16 | Path Traversal | Multiple Products | 中 5.4 | 1.4% |
| 2026/10/01 | Path Traversal | FortiMail | 緊急 9.8 | 4.6% |
| 2026/09/09 | Heap-based Buffer Overflow | Multiple Products | 高 7.4 | 3.7% |
| 2026/07/27 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | 中 5.3 | 29% |
| 2026/07/16 | OS Command Injection | FortiSandbox | 緊急 9.1 | 76% |
| 2026/07/16 | OS Command Injection | FortiSandbox | 緊急 9.1 | 93% |
| 2026/04/13 | SQL Injection | FortiClient EMS | 緊急 9.1 | 98% |
| 2026/04/06 | Improper Access Control | FortiClient EMS | 緊急 9.1 | 94% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。