CVE-2024-50566: Fortinet FortiManager RCE Vulnerability

CVE-2024-50566 Overview

CVE-2024-50566 is an OS command injection vulnerability [CWE-78] affecting Fortinet FortiManager and FortiManager Cloud. The flaw resides in the FortiGate to FortiManager (FGFM) protocol handler, where crafted requests can inject shell metacharacters into an operating system command. An authenticated remote attacker can leverage this weakness to execute unauthorized code on the appliance. Fortinet published the advisory under FG-IR-24-463 on January 14, 2025.

Critical Impact
An authenticated attacker with network access to FGFM can execute arbitrary commands on FortiManager appliances, compromising centralized management of downstream FortiGate devices.

Affected Products

FortiManager 7.2.1 through 7.2.8, 7.4.0 through 7.4.5, and 7.6.0 through 7.6.1
FortiManager Cloud 7.2.2 through 7.2.7, 7.4.0 through 7.4.4, and 7.6.0 through 7.6.1
FGFM protocol service on affected FortiManager platforms

Discovery Timeline

2025-01-14 - CVE-2024-50566 published to NVD and Fortinet advisory FG-IR-24-463 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50566

Vulnerability Analysis

The vulnerability is classified as improper neutralization of special elements used in an OS command [CWE-78]. FortiManager exposes the FGFM service to accept management traffic from managed FortiGate devices and administrators. Input fields received over FGFM are passed into a downstream OS command without adequate sanitization of shell metacharacters. An authenticated remote attacker who can reach the FGFM listener can inject additional commands into the constructed command line.

Because FortiManager centrally manages fleets of FortiGate firewalls, successful exploitation places an attacker in a position to alter policy pushes, extract device configurations, or pivot into managed environments. The Common Weakness Enumeration category and vendor description both point to the FGFM request parser as the injection sink.

Root Cause

The root cause is the direct interpolation of attacker-influenced fields from FGFM requests into a shell command. Special characters such as ;, |, &, backticks, or $() are not stripped or escaped before invocation. The command executes with the privileges of the FGFM service process on the FortiManager host.

Attack Vector

Exploitation requires network access to the FGFM service and valid authentication material accepted by that service. The attacker submits a crafted FGFM request containing shell metacharacters inside a field that reaches the vulnerable command construction. The command interpreter then executes the injected payload alongside the intended command, yielding code execution on the appliance.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-50566

Indicators of Compromise

Unexpected FGFM sessions originating from source addresses outside the managed FortiGate inventory.
Shell metacharacters such as ;, |, backticks, or $() observed inside FGFM request payloads.
New or modified files, cron entries, or outbound connections from FortiManager appliances that do not match a change window.
Administrative account activity or configuration pushes that do not correlate with an authorized operator session.

Detection Strategies

Inspect FortiManager event logs and FGFM protocol logs for malformed request fields and repeated authentication attempts from unfamiliar sources.
Correlate process execution telemetry on FortiManager hosts with expected FGFM activity to surface unexpected child processes such as sh, bash, wget, or curl.
Alert on outbound network connections initiated by FortiManager to destinations that are not Fortinet update, license, or telemetry endpoints.

Monitoring Recommendations

Forward FortiManager system, event, and FGFM logs into a centralized analytics platform for retention and correlation.
Baseline the normal set of managed FortiGate serial numbers and source IPs communicating over FGFM and alert on deviations.
Monitor for privileged CLI command execution and configuration exports outside approved maintenance windows.

How to Mitigate CVE-2024-50566

Immediate Actions Required

Upgrade FortiManager and FortiManager Cloud to the fixed versions listed in Fortinet advisory FG-IR-24-463.
Restrict FGFM exposure so that only known FortiGate management IP ranges can reach TCP port 541.
Rotate administrative credentials and API keys on FortiManager if compromise is suspected.
Review FortiManager audit logs for command execution or configuration changes since the earliest affected version was deployed.

Patch Information

Fortinet has released fixed builds for each supported branch of FortiManager and FortiManager Cloud. Refer to the Fortinet Security Advisory FG-IR-24-463 for the exact fixed version numbers and upgrade guidance for versions 7.2.x, 7.4.x, and 7.6.x.

Workarounds

Place FortiManager behind a dedicated management network and block FGFM access from untrusted zones using upstream firewalls.
Enforce set fgfm-deny-unknown enable behavior so unregistered devices cannot initiate FGFM handshakes.
Apply local-in policies on FortiManager that permit FGFM connections only from allow-listed FortiGate addresses.

bash

# Example local-in policy restricting FGFM (TCP/541) to known management sources
config system local-in-policy
  edit 1
    set intf "port1"
    set srcaddr "MGMT_FGT_Devices"
    set dstaddr "all"
    set action accept
    set service "FGFM"
    set schedule "always"
  next
  edit 2
    set intf "port1"
    set srcaddr "all"
    set dstaddr "all"
    set action deny
    set service "FGFM"
    set schedule "always"
  next
end