Skip to content
Today
Sections

Security Widely confirmed5 publishers 2 min read Published Updated

FortiManager flaw CVE-2024-47575 exposed configs and private keys for 500+ FortiGate firewalls

Attackers exploiting CVE-2024-47575 on one FortiManager took running configs for more than 500 managed FortiGate firewalls, Unit 42 reports. Patching the manager does not retire the credentials and private keys in that archive.

The Watch · Security desk

Send a correction

Illustration accompanying FortiManager flaw CVE-2024-47575 exposed configs and private keys for 500+ FortiGate firewalls
Generated illustration
One hacked FortiManager exposed the firewalls it ran How one compromised FortiManager reaches the firewalls it manages, their credentials and keys, and the provider's clients, per Unit 42.

FortiManager on TCP 541: unauthenticated attackers can run commands. More than 500 managed FortiGates: configs, crypto material, databases taken. Archive: credentials, private keys. Downstream FortiGates: sniffer configs pushed. Clients: networks not examined, no confirmed intrusion.

One hacked FortiManager exposed the firewalls it ran
WhoHowKindClaim
FortiManager on TCP port 541CVE-2024-47575 lets an unauthenticated remote attacker run arbitrary commands via FMG-Accesscapability12
500+ managed FortiGatesConfigs, cryptographic material and database files for more than 500 exfiltrated from one applianceexposure1
Firewall credentials and keysArchive held ciphertext admin, local and SSL/VPN credentials, certificates and private keysexposure6
Downstream managed FortiGatesAttackers used the FortiManager to push unauthorized sniffer configurations to multiple of themexposure14
The provider's clientsUnit 42 did not examine their networks; exposure is config and credential material, not confirmed intrusionconstraint8

What happened

  • The intrusion dates to September 2024, hit a telecommunications organization, and is tracked by Unit 42 as CL-STA-0954, also called UNC5820.
  • The exfiltrated .tm archive held full running configs, two SQLite databases, an inventory of serial numbers with public IPs, and network topology maps and routing tables.
  • The attackers then exploited CVE-2025-61624, a FortiOS auto-script path traversal, to deploy PEERSTITCH, a novel memory-resident ARM64 implant.
  • PEERSTITCH leaves no binary on disk, opens no listening ports and makes no outbound connections, communicating through traffic that legitimate host processes generate.

Why it matters

  • Who's exposed exposure The provider's clients sit behind firewalls whose configs and credentials were taken, but Unit 42 examined only the provider's environment and confirms no intrusion into client networks.
  • What it limits constraint Scanning for PEERSTITCH on disk or open ports will turn up nothing, so we think detection has to start at the management plane.
  • Who has to decide decision Operators with a FortiManager reachable on TCP 541 must decide whether to treat it as breached until a rogue registered device and a .tm archive are ruled out.

The entry condition is a reachable port. CVE-2024-47575 (called FortiJump by external parties) lets an unauthenticated remote attacker run commands through crafted requests to the FMG-Access channel on TCP 541 [12]. A FortiManager whose port 541 outside hosts can reach is exposed to it.

Unit 42 says the attackers used the stolen information to maintain long-term access, intercept traffic, establish VPN sessions and deploy backdoors [15]. After an extended dwell period they used the compromised FortiManager to push sniffer configurations to multiple downstream FortiGates [14]. They also impersonated the FortiManager to pull from managed firewalls of other hosts in the network [16]. The sniffer pushes ran through the manager itself. Planting PEERSTITCH took a second flaw, CVE-2025-61624 [9].

Two named vulnerabilities, a rogue device registration, manager impersonation and a novel ARM64 implant make a toolset. Unit 42 said the attackers showed proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols [7]. It also said parts of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors [17]. We think that fits a sustained operation better than a one-off exploit run. Unit 42 describes a single victim [2], so the evidence for a wider campaign is not in this report.

Keep what is published apart from what is suspected. Published: the rogue device's name (localhost) and serial number (FMG-VMTM23017412), and two attacker addresses, 45.32.41[.]202 and later 198.199.122[.]22 [13]. Also published: the archive name, .tm [3]. Suspected: the nation-state link, and Unit 42 does not name a state.

The archive is the reason a patch is only the first step. It held ciphertext administrative, local and SSL/VPN credentials, plus encoded trust material that included public certificates and private keys [6]. The firewalls it covered numbered more than 500 [1]. In our view, any operator who finds the same indicators on a FortiManager has to treat everything the manager held as taken, and replace it on each managed device.

What to watch

  • Fortinet advisory dates and fixed versions for CVE-2025-61624, which Unit 42 places in a September 2024 intrusion.
  • Any report of client-network intrusion built on the stolen configs, since Unit 42 did not examine those networks.
  • A second victim showing the rogue localhost device or a .tm archive, which would move this from one provider to a campaign.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence68
Adoption
Not scored
Hype gap+10
Incentives40
Confidence70

Perspective Coverage

5 publishers
Builder
Builder 30%
Operator
Operator 60%
Investor
Investor 10%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    From that single appliance the attackers exfiltrated an archive containing running configurations, cryptographic material and database files for more than 500 managed FortiGate firewalls.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  2. [2]

    Unit 42 investigated a multi-stage network intrusion against a telecommunications organization in September 2024, tracked as cluster CL-STA-0954 (aka UNC5820).

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  3. [3]

    Immediately after device registration, the attacker generated a configuration archive named .tm in the FortiManager file system and exfiltrated it shortly after.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  4. [4]

    The .tm archive contained complete running configurations for more than 500 managed FortiGates, the SQLite databases global.db and revinfo.db, a flat inventory of more than 500 FortiGate serial numbers with their public IP addresses, and internal network topology maps, routing tables and interface configurations.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  5. [5]

    The managed firewalls protected the target's own infrastructure and the networks of its clients.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  6. [6]

    The archive also contained ciphertext administrative, local and SSL/VPN credentials, and encoded cryptographic trust material including public certificates and private keys.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  7. [7]

    The victim was a telecommunications managed service provider, and the attackers demonstrated proficiency in Fortinet appliance architecture, FortiOS internals and FortiOS management protocols.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  8. [8]

    Unit 42's investigation spanned the provider's own environment and did not examine the client networks whose firewalls the provider managed; the exposure described is of configuration and credential material rather than confirmed intrusion into those networks.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  9. [9]

    The attackers exploited CVE-2025-61624 via FortiOS auto-script path traversal, which facilitated deployment of PEERSTITCH, a novel memory-resident ARM64 malware.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  10. [10]

    PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections; it communicates through traffic generated by legitimate processes on the infected host, which Unit 42 says makes it resistant to conventional endpoint and network detection.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  11. [11]

    The attackers achieved initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  12. [12]

    CVE-2024-47575 (called FortiJump by external parties) allows an unauthenticated remote attacker to execute arbitrary commands via crafted requests to the FMG-Access management channel on TCP port 541.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  13. [13]

    During exploitation the attackers registered a rogue Virtual FortiGate appliance named localhost (serial number FMG-VMTM23017412) to the central FortiManager from attacker infrastructure at 45.32.41[.]202, later changed to 198.199.122[.]22.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  14. [14]

    Following an extended dwell period, the attackers used the compromised FortiManager to push unauthorized sniffer configurations to multiple downstream managed FortiGate firewalls.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  15. [15]

    Armed with the stolen information, the attackers maintained long-term access, intercepted network traffic, established VPN sessions, deployed backdoors and exploited a separate privilege-escalation vulnerability.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  16. [16]

    The attackers also impersonated the FortiManager platform to pull from managed firewalls of other hosts in the targeted network.

    Reported Supported Source: Unit 42, Palo Alto NetworksView cited source
  17. [17]

    Aspects of the post-exploitation activity overlap with intrusions attributed to suspected nation-state actors.

    Reported Insufficient Source: Unit 42, Palo Alto NetworksView cited source

Sources

5 independent publishers whose own reporting we read for this story.

  1. dev.to

    2 articles · October 15, 2026

    PEERSTITCH: Theft of 500+ Firewall Configurations and Payload Injection into FortiGate Daemons
  2. scworld.com

    1 article · October 16, 2026

    New PEERSTITCH malware exploits Fortinet flaw for covert communication
  3. securityaffairs.com

    1 article · October 16, 2026

    PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
  4. thehackernews.com

    1 article · October 15, 2026

    PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
  5. unit42.paloaltonetworks.com

    1 article · October 14, 2026

    Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Topics and entities

Topics

Entities