FortiManager flaw CVE-2024-47575 exposed configs and private keys for 500+ FortiGate firewalls
Attackers exploiting CVE-2024-47575 on one FortiManager took running configs for more than 500 managed FortiGate firewalls, Unit 42 reports. Patching the manager does not retire the credentials and private keys in that archive.
The Watch · Security desk
FortiManager on TCP 541: unauthenticated attackers can run commands. More than 500 managed FortiGates: configs, crypto material, databases taken. Archive: credentials, private keys. Downstream FortiGates: sniffer configs pushed. Clients: networks not examined, no confirmed intrusion.
- capability FortiManager on TCP port 541 CVE-2024-47575 lets an unauthenticated remote attacker run arbitrary commands via FMG-Access, claim 7
- exposure 500+ managed FortiGates Configs, cryptographic material and database files for more than 500 exfiltrated from one appliance, claim 3
- exposure Firewall credentials and keys Archive held ciphertext admin, local and SSL/VPN credentials, certificates and private keys, claim 11
- exposure Downstream managed FortiGates Attackers used the FortiManager to push unauthorized sniffer configurations to multiple of them, claim 12
- constraint The provider's clients Unit 42 did not examine their networks; exposure is config and credential material, not confirmed intrusion, claim 6
| Who | How | Kind | Claim |
|---|---|---|---|
| FortiManager on TCP port 541 | CVE-2024-47575 lets an unauthenticated remote attacker run arbitrary commands via FMG-Access | capability | 7 |
| 500+ managed FortiGates | Configs, cryptographic material and database files for more than 500 exfiltrated from one appliance | exposure | 3 |
| Firewall credentials and keys | Archive held ciphertext admin, local and SSL/VPN credentials, certificates and private keys | exposure | 11 |
| Downstream managed FortiGates | Attackers used the FortiManager to push unauthorized sniffer configurations to multiple of them | exposure | 12 |
| The provider's clients | Unit 42 did not examine their networks; exposure is config and credential material, not confirmed intrusion | constraint | 6 |
What happened
- The intrusion dates to September 2024, hit a telecommunications organization, and is tracked by Unit 42 as CL-STA-0954, also called UNC5820.
- The exfiltrated .tm archive held full running configs, two SQLite databases, an inventory of serial numbers with public IPs, and network topology maps and routing tables.
- The attackers then exploited CVE-2025-61624, a FortiOS auto-script path traversal, to deploy PEERSTITCH, a novel memory-resident ARM64 implant.
- PEERSTITCH leaves no binary on disk, opens no listening ports and makes no outbound connections, communicating through traffic that legitimate host processes generate.
Why it matters
- exposure The provider's clients sit behind firewalls whose configs and credentials were taken, but Unit 42 examined only the provider's environment and confirms no intrusion into client networks.
- constraint Scanning for PEERSTITCH on disk or open ports will turn up nothing, so we think detection has to start at the management plane.
- decision Operators with a FortiManager reachable on TCP 541 must decide whether to treat it as breached until a rogue registered device and a .tm archive are ruled out.
The entry condition is a reachable port. CVE-2024-47575 (called FortiJump by external parties) lets an unauthenticated remote attacker run commands through crafted requests to the FMG-Access channel on TCP 541 [7]. A FortiManager whose port 541 outside hosts can reach is exposed to it.
Unit 42 says the attackers used the stolen information to maintain long-term access, intercept traffic, establish VPN sessions and deploy backdoors [13]. After an extended dwell period they used the compromised FortiManager to push sniffer configurations to multiple downstream FortiGates [12]. They also impersonated the FortiManager to pull from managed firewalls of other hosts in the network [16]. The sniffer pushes ran through the manager itself. Planting PEERSTITCH took a second flaw, CVE-2025-61624 [14].
Two named vulnerabilities, a rogue device registration, manager impersonation and a novel ARM64 implant make a toolset. Unit 42 said the attackers showed proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols [5]. It also said parts of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors [17]. We think that fits a sustained operation better than a one-off exploit run. Unit 42 describes a single victim [1], so the evidence for a wider campaign is not in this report.
Keep what is published apart from what is suspected. Published: the rogue device's name (localhost) and serial number (FMG-VMTM23017412), and two attacker addresses, 45.32.41[.]202 and later 198.199.122[.]22 [8]. Also published: the archive name, .tm [9]. Suspected: the nation-state link, and Unit 42 does not name a state.
The archive is the reason a patch is only the first step. It held ciphertext administrative, local and SSL/VPN credentials, plus encoded trust material that included public certificates and private keys [11]. The firewalls it covered numbered more than 500 [3]. In our view, any operator who finds the same indicators on a FortiManager has to treat everything the manager held as taken, and replace it on each managed device.
What to watch
- Fortinet advisory dates and fixed versions for CVE-2025-61624, which Unit 42 places in a September 2024 intrusion.
- Any report of client-network intrusion built on the stolen configs, since Unit 42 did not examine those networks.
- A second victim showing the rogue localhost device or a .tm archive, which would move this from one provider to a campaign.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−10
- Incentives40
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Unit 42 investigated a multi-stage network intrusion against a telecommunications organization in September 2024, tracked as cluster CL-STA-0954 (aka UNC5820).
- [2]
The attackers achieved initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.
- [3]
From that single appliance the attackers exfiltrated an archive containing running configurations, cryptographic material and database files for more than 500 managed FortiGate firewalls.
- [4]
The managed firewalls protected the target's own infrastructure and the networks of its clients.
- [5]
The victim was a telecommunications managed service provider, and the attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols.
- [6]
Unit 42's investigation spanned the provider's own environment and did not examine the client networks whose firewalls the provider managed; the exposure described is of configuration and credential material rather than confirmed intrusion into those networks.
- [7]
CVE-2024-47575 (called FortiJump by external parties) allows an unauthenticated remote attacker to execute arbitrary commands via crafted requests to the FMG-Access management channel on TCP port 541.
- [8]
During exploitation the attackers registered a rogue Virtual FortiGate appliance named localhost (serial number FMG-VMTM23017412) to the central FortiManager from attacker infrastructure at 45.32.41[.]202, later changed to 198.199.122[.]22.
- [9]
Immediately after device registration, the attacker generated a configuration archive named .tm in the FortiManager file system and exfiltrated it shortly after.
- [10]
The .tm archive contained complete running configurations for more than 500 managed FortiGates, the SQLite databases global.db and revinfo.db, a flat inventory of more than 500 FortiGate serial numbers with their public IP addresses, and internal network topology maps, routing tables and interface configurations.
- [11]
The archive also contained ciphertext administrative, local and SSL/VPN credentials, and encoded cryptographic trust material including public certificates and private keys.
- [12]
Following an extended dwell period, the attackers used the compromised FortiManager to push unauthorized sniffer configurations to multiple downstream managed FortiGate firewalls.
- [13]
Armed with the stolen information, the attackers maintained long-term access, intercepted network traffic, established VPN sessions, deployed backdoors and exploited a separate privilege-escalation vulnerability.
- [14]
The attackers exploited CVE-2025-61624 via FortiOS auto-script path traversal, which facilitated deployment of PEERSTITCH, a novel memory-resident ARM64 malware.
- [15]
PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections; it communicates through traffic generated by legitimate processes on the infected host, which Unit 42 says makes it resistant to conventional endpoint and network detection.
- [16]
The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.
- [17]
Aspects of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- unit42.paloaltonetworks.comUnit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Managed provider accountabilityFollow
- Threat Intelligence and Incident ResponseFollow
- Network Appliance SecurityFollow