TeliApp Corporation — IT and cybersecurity for New Jersey government
←Back to Intelligence Feed
This Multi-State Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals. A vulnerability has been discovered in Fortinet FortiManager which could allow for remote code execution. FortiManager is a network and security management tool that provides centralized management of Fortinet devices from a single console. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the system. Depending on the privileges associated with the service account, threat actors could install programs; view, change, or delete data. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Threat Intelligence
Fortinet and CISA report that CVE-2024-47575 is being exploited in the wild.
Systems Affected
  • FortiManager 7.6.0
  • FortiManager 7.4.0 through 7.4.4
  • FortiManager 7.2.0 through 7.2.7
  • FortiManager 7.0.0 through 7.0.12
  • FortiManager 6.4.0 through 6.4.14
  • FortiManager 6.2.0 through 6.2.12
  • FortiManager Cloud 7.4.1 through 7.4.4
  • FortiManager Cloud 7.2.1 through 7.2.7
  • FortiManager Cloud 7.0.1 through 7.0.12
  • FortiManager Cloud 6.4 all versions
Risk Government:
- Large and medium government entities: High
- Small government entities: Medium
Businesses:
- Large and medium business entities: High - Small business entities: Medium
Home Users: Low
Technical Summary A vulnerability has been discovered in Fortinet FortiManager which could allow for remote code execution.
Recommendations
  • Apply appropriate updates provided by Fortinet to vulnerable systems immediately after appropriate testing.
  • Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them.
  • Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.
  • Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.
  • Restrict use of certain websites, block downloads/attachments, block JavaScript, restrict browser extensions, etc.
  • Remind users not to visit untrusted websites or follow links provided by unknown or untrusted sources. Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from untrusted sources.
Reference Fortinet: https://www.fortiguard.com/<wbr />psirt/FG-IR-24-423
Reporting
The NJCCIC encourages recipients who discover signs of malicious cyber activity to contact the NJCCIC via the cyber incident report form at www.cyber.nj.gov/report.
Please do not hesitate to contact us at cybercc.org <wbr />with any questions.  Also, for more background on our recent cybersecurity efforts, please visit cyber.nj.gov.