DEV Community

jeffrey
jeffrey

Posted on

Two CVEs, One Intrusion: Sorting Priorities When Scores Mislead

#fortinet #cve202447575 #cve202561624 #patchprioritisation

Two CVEs, One Intrusion: Sorting Priorities When Scores Mislead

CVE-2024-47575 scores 9.8. CVE-2025-61624 scores 6.0 in its local vector and 6.5 in its network vector. A vulnerability management programme that sorts by score will patch the first and schedule the second. In the CL-STA-0954 intrusion, both were used, and the second one delivered the implant.

That sequence is worth walking through, because it explains why a score-driven queue produces the wrong answer.

What each flaw actually did

CVE-2024-47575 is a missing authentication flaw in FortiManager. NVD describes it as allowing an attacker to execute arbitrary code or commands through specially crafted requests, affecting FortiManager 6.2 through 7.6 and FortiManager Cloud releases in the same generations. Unit 42 reports that the attackers used crafted requests to the FMG-Access management channel on TCP port 541 and registered a rogue virtual FortiGate on the appliance.

CVE-2025-61624 is a path traversal, CWE-22, in the FortiOS command line interpreter. NVD lists FortiOS 7.4.0 through 7.4.9 and 7.6.0 through 7.6.4 among the affected ranges, along with FortiProxy, FortiPAM and FortiSwitchManager releases, and describes it as requiring an authenticated attacker with high privileges. The vector explains the low score: the attacker already needs a foothold and privileged context.

In this campaign, that prerequisite was satisfied. The attackers held administrative material from the stolen FortiManager archive. They used the path traversal through a FortiOS auto-script to deploy PEERSTITCH. A medium-severity flaw became the delivery mechanism because the high-severity flaw had already provided everything it needed.

What an external view contributes

ZoomEye measurements on 2026-10-22 show the two populations are indexed very differently.

  • vul.cve="CVE-2024-47575" returned 0 assets.
  • app="FortiManager" returned 1; app="FortiManager" && port="443" returned 0.
  • title="FortiManager" returned 711,074.
  • app="Fortinet FortiGate" returned 38,987.

A zero in the CVE index is not evidence that nothing is vulnerable. It means the index holds no assets currently mapped to that CVE, which is common for management appliances that sit behind access controls and are indexed by banner or title rather than by vulnerability tag. The product-level queries describe what exists, not what is exposed to either flaw.

A prioritisation approach that survives this case

Sort by reachability and consequence rather than by score alone.

  1. Reachable management interfaces. Any FortiManager accepting FMG-Access from an untrusted network is the first item regardless of patch state, because the management channel is the trust root.
  2. Local-privilege flaws on devices that already store privileged material. A path traversal that needs high privileges is only low risk if the device does not hold credentials for anything else. Edge appliances usually do.
  3. Auto-script capability. If auto-script objects can be created and executed on a device, treat that capability as an attack surface in its own right and review who can create them.
  4. Version reconciliation. Map NVD ranges to installed firmware. This is the step that turns two CVE entries into a patch list.

Why the score is not wrong

CVSS measures the flaw in isolation, assuming a starting position. CVE-2025-61624 genuinely needs privileged access. The mistake is in reading that score as a statement about your environment, where privileged material for hundreds of devices may sit on one appliance behind one missing authentication check.

The intrusion did not exploit a scoring error. It exploited the difference between a component's isolated risk and its risk in a chain.

References

Top comments (0)