CVE-2024-47575: 'FortiJump' Missing Authentication in FortiManager FGFM Daemon
A missing authentication for critical function vulnerability [CWE-306] in the FortiManager fgfmd daemon allows remote unauthenticated actors to connect via valid factory certificates, register rogue devices, execute arbitrary commands, and exfiltrate managed FortiGate configurations.
Technical Root Cause Analysis
The FortiManager FGFM protocol daemon (/bin/fgfmd) handles device discovery and bi-directional policy deployment with managed FortiGate units over TCP port 541. To establish the mutual TLS (mTLS) tunnel, both ends present Fortinet factory-issued certificates signed by the Fortinet factory CA.
Due to a missing secondary authentication verification step during initial registration, FortiManager accepted any TLS client connection presenting a genuine Fortinet certificate (which could be harvested from any consumer FortiGate or test appliance). Once connected, the unauthorized client was permitted to send arbitrary FGFM RPC commands without validating whether the hardware serial number had been pre-authorized by an administrator.
Threat actors leveraged this flaw in automated zero-day attacks to register rogue devices, dump the FortiManager device inventory database, and extract full configuration files—including hashed admin credentials, IPsec pre-shared keys, SSL certificates, and sensitive routing policies for all managed FortiGates.
Affected Firmware & Blast Radius Matrix
| Product / Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiManager 7.4 | 7.4.0 – 7.4.4 | 7.4.5+ | Apply fgfm-local-cert or upgrade |
| FortiManager 7.2 | 7.2.0 – 7.2.7 | 7.2.8+ | Apply custom certificate profile |
| FortiManager 7.0 | 7.0.0 – 7.0.12 | 7.0.13+ | Upgrade to 7.0.13 or 7.2.8 LTS |
| FortiManager 7.6 | 7.6.0 | 7.6.1+ | Upgrade to 7.6.1+ |
| Managed FortiGate (All) | Downstream Exposure | Audit Credentials | Pin FMG serial & rotate VPN/admin secrets |
Platform Impact: Affects all FortiManager deployments exposed on TCP port 541. Every FortiGate managed by a vulnerable FortiManager must be treated as potentially exposed to credential and configuration exfiltration.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands on each FortiGate to verify central management connectivity, audit the linked FortiManager serial number, and inspect FDSM process state:
Diagnostic Commands
# 1. Audit FortiGate Device Service Management (FDSM) connection status and socket health
diagnose fdsm status
# 2. Query central management registration state and connected FortiManager serial number
execute central-management status
# 3. Verify FortiGate central management configuration, server IP, and authorization mode
show system central-managementRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
FortiManager's fgfmd accepted client connections validated by generic Fortinet factory CA certificates without enforcing specific serial authorization, allowing attackers with any Fortinet device certificate to issue unauthorized FGFM commands.
Attackers extracted complete device configurations from compromised FortiManagers, including system administrator passwords, local user hashes, and IPsec pre-shared keys.
Patch FortiManager immediately to 7.2.8+ or 7.4.5+, verify serial pinning on managed FortiGates, and rotate all sensitive credentials stored across the managed firewall fleet.