Fortinet CVE-2024-47575 Exploited in 2024 Against 500+ Firewalls

Key points

• CVE-2024-47575 was exploited in 2024 against Fortinet firewall products.
• More than 500 FortiGate and FortiManager systems were targeted.
• PEERSTITCH malware operated from memory, complicating detection.
• Palo Alto Networks is referenced in the same threat context.
• Admins should investigate signs of intrusion and patch exposed devices.

In 2024, attackers took advantage of a vulnerability tracked as CVE-2024-47575 to break into Fortinet's FortiGate and FortiManager offerings. The campaign reached beyond five hundred firewalls, indicating a broad and coordinated effort rather than an isolated incident. The activity centered on security appliances that many organizations rely on as perimeter defenses.

Once inside, the intruders compromised firewall systems and pushed malicious software. A notable payload was PEERSTITCH, described as an implant that resides in memory. Because it does not necessarily leave traditional files on disk, this memory-resident approach can make forensic discovery harder and allow the threat to persist quietly while administrators investigate.

The mention of Palo Alto Networks in the same set of facts suggests defenders should not assume the threat is limited to a single vendor's ecosystem. Even if the primary exploitation involved Fortinet products, cross-vendor visibility matters when attackers move through hybrid environments. The scale—over 500 firewalls—shows how quickly a single flaw can become an enterprise-wide problem.

Why it matters: Firewalls are trust anchors. If they are compromised, attackers can alter rules, exfiltrate traffic, or stage follow-on malware. A memory-resident implant can evade routine scans, so organizations need to examine logs, memory, and configuration changes. The 2024 timing means some victims may still be unaware, especially if logging was incomplete.

What to watch: New exploitation attempts, unexpected outbound connections, unexplained admin activity, and signs of PEERSTITCH. IT teams should investigate any intrusion indicators, validate firmware integrity, and monitor FortiGate and FortiManager devices closely. Palo Alto Networks telemetry may also help correlate suspicious behavior across the network.

What to do now

1. Patch or mitigate CVE-2024-47575 on all FortiGate and FortiManager devices immediately; if patching is delayed, restrict management access to trusted networks.
2. Hunt for PEERSTITCH and other memory-resident implants using memory forensics, EDR telemetry, and known indicators; do not rely on disk scans alone.
3. Review firewall logs and admin activity from 2024 onward for unauthorized rule changes, new accounts, or unusual outbound connections.
4. Isolate and rebuild any confirmed compromised firewall rather than cleaning in place, then rotate credentials and certificates.
5. Enable centralized logging and alerting for Fortinet and Palo Alto Networks devices, and correlate events across vendors.
6. Conduct an intrusion investigation with forensic support if more than 500 firewalls were affected in your sector or if PEERSTITCH indicators appear.
7. Apply least privilege to firewall management interfaces, enforce MFA, and segment management planes from production traffic.

CVE references

• CVE-2024-47575

Original source

Unit 42