Fortinet has disclosed a critical missing authentication vulnerability with a CVSS score of 9.8 in its centralized management solution, FortiManager (CVE-2024-47575, dubbed ‘FortiJump’). With active exploitation observed in targeted espionage campaigns, the U.S. CISA has issued an emergency binding operational directive mandating immediate remediation across government and enterprise networks.
Root Cause and Exploit Dynamics
The flaw resides in the ‘fgfmd’ communication daemon listening on TCP port 541, which coordinates configuration syncs across managed FortiGate units. Due to insufficient verification of incoming connections, an unauthenticated remote adversary can transmit crafted packets to execute arbitrary commands, exfiltrate sensitive configuration archives, and compromise downstream managed firewall clusters.
Affected Versions and Immediate Mitigation
Vulnerable releases span FortiManager 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, and 7.0.0 through 7.0.12. Administrators must upgrade immediately to patched builds (7.4.5, 7.2.8, 7.0.13 or later). Where immediate patching is unfeasible, enforce device certificate verification and restrict TCP 541 access strictly to trusted administrative IP addresses.