CVE-2024-47571
Fortinet Fortimanager 7.0.7 – 7.0.9
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-47571 is a high-severity Operation on a Resource after Expiration or Release (CWE-672) vulnerability in Fortinet Fortimanager. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-47571 is a vulnerability involving an operation on a resource after its expiration or release (CWE-672) in Fortinet FortiManager versions 6.4.12 through 7.4.0. This flaw enables an attacker to gain improper access to connected FortiGate devices using valid credentials. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), reflecting network accessibility (AV:N), high attack complexity (AC:H), no required privileges (PR:N), no user interaction (UI:N), and unchanged scope (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
An unauthenticated attacker with network access to the vulnerable FortiManager instance can exploit this issue despite the high complexity requirement. Successful exploitation allows the attacker to leverage valid credentials for improper access to FortiGate firewalls managed by the FortiManager, potentially enabling full compromise of those devices through unauthorized read, modification, or disruption of configurations and operations.
Fortinet's advisory (FG-IR-24-239) at https://fortiguard.fortinet.com/psirt/FG-IR-24-239 provides details on mitigation, including available patches for affected FortiManager versions. Security practitioners should consult this advisory for upgrade instructions and any temporary workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42864
Vulnerability Data
An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies current authorizations to every request, directly blocking operations once a resource has been revoked or released.
Authenticator management mandates revocation and replacement procedures that render expired credentials unusable.
Account lifecycle management includes explicit revocation and disabling steps that stop subsequent operations on released accounts or identifiers.
Identifier management requires deallocation and reuse controls that prevent continued use of released identifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect use-after-release but does not prevent it at runtime.
Enforces timely deletion of resources so they cannot be used after release.
Secure-coding rules require checks that prevent operations on freed or expired objects.
Change-management processes can introduce or remove resource-lifetime controls.