“Fortinet warns that not all IOCs may be present on exploited devices.”
CVE-2024-47575 is a 9.8 missing-authentication flaw in FortiManager, exploited to steal managed device IPs, credentials and configurations. Fortinet warned customers privately from October 13 and published ten days later, and some say they learned from leaks. Shodan shows about 59,534 FortiManager devices exposed. The box that manages the firewalls handed out their keys.