FortiOS flaw used to plant a memory-only implant in a 2024 intrusion
Attackers used FortiOS flaw to get root and load PEERSTITCH, a memory-only implant that opens no ports, in an intrusion Unit 42 dates to September 2024. They first broke into a telecom MSP’s FortiManager through and stole a configuration archive covering more than 500 FortiGates. Fortinet’s April advisory rates the flaw medium, with a CVSS 3.1 score of 6.0, and CISA added it to KEV on Oct 16.
- Editor
- Austin Simas
- Updated
- Corrections
- None
- CVE
- Vendor
- Fortinet
What to do
3 steps
- 1 Upgrade FortiOS to 7.6.5 or 7.4.10 or later; 7.2, 7.0 and 6.4 must move to a fixed branch.
- 3 Rotate the credentials and certificates held by any FortiManager ever exposed to CVE-2024-47575, since Unit 42 says stolen trust material stays valid until rotated.
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 7.6 | through | or later |
| FortiOS 7.4 | through | or later |
| FortiOS 7.2, 7.0 and 6.4 | All versions | Migrate to a fixed release |
| FortiPAM 1.7 | or later | |
| FortiPAM 1.0 to 1.6 | All versions | Migrate to a fixed release |
| FortiProxy 7.6 | through | or later |
| FortiProxy 7.4 | through | or later |
| FortiProxy 7.2 and 7.0 | All versions | Migrate to a fixed release |
| FortiSwitchManager 7.2 | through | or later |
| FortiSwitchManager 7.0 | through | or later |
- Product
- FortiOS 7.6
- Affected
- through
- Fixed
- or later
- Product
- FortiOS 7.4
- Affected
- through
- Fixed
- or later
- Product
- FortiOS 7.2, 7.0 and 6.4
- Affected
- All versions
- Fixed
- Migrate to a fixed release
- Product
- FortiPAM 1.7
- Affected
- Fixed
- or later
- Product
- FortiPAM 1.0 to 1.6
- Affected
- All versions
- Fixed
- Migrate to a fixed release
- Product
- FortiProxy 7.6
- Affected
- through
- Fixed
- or later
- Product
- FortiProxy 7.4
- Affected
- through
- Fixed
- or later
- Product
- FortiProxy 7.2 and 7.0
- Affected
- All versions
- Fixed
- Migrate to a fixed release
- Product
- FortiSwitchManager 7.2
- Affected
- through
- Fixed
- or later
- Product
- FortiSwitchManager 7.0
- Affected
- through
- Fixed
- or later
Timeline
- Oct 23CISA adds FortiManager’s to its KEV catalog.
- Apr 14Fortinet publishes advisory for , rated medium and marked as known exploited.
- Oct 14Unit 42 publishes its report on the intrusion and PEERSTITCH.
- Oct 16CISA adds to its KEV catalog, with a due date of Oct 19.
Corrections
No corrections to this story.
Spotted an error? Tell us and we’ll correct it.