Security1 hOctober 24, 2026, 23:02

Analysis: medium-severity FortiOS flaw delivered implant in CL-STA-0954 attack

A Unit 42 breakdown shows how the CL-STA-0954 intrusion chained two Fortinet flaws: critical CVE-2024-47575 (9.8) in FortiManager and path traversal CVE-2025-61624 (6.0) in FortiOS. The first exposed privileged material, the second deployed the PEERSTITCH implant via an auto-script.

DEV Community

Open source

Analysis: medium-severity FortiOS flaw delivered implant in CL-STA-0954 attack

CVE-2024-47575 in FortiManager: 9.8, auth bypass on port 541
CVE-2025-61624 in FortiOS: 6.0, path traversal needs privileges
PEERSTITCH implant delivered through a FortiOS auto-script
ZoomEye: 0 assets tagged CVE-2024-47575, 711,074 by FortiManager title

#Fortinet#FortiManager#FortiOS

PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624

Security

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

Security

Fortinet patches four SQL injection flaws in FortiAnalyzer and FortiManager

Security

Analysis: medium-severity FortiOS flaw delivered implant in CL-STA-0954 attack

PEERSTITCH malware delivered via FortiOS flaw CVE-2025-61624

Unit 42 uncovers PEERSTITCH implant: configs of 500+ FortiGate devices stolen

Fortinet patches four SQL injection flaws in FortiAnalyzer and FortiManager

FortiOS CVE-2025-61624 scores 6.0 but is exploited to root firewalls