CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass
Remote attackers can gain super-admin privileges via crafted requests to the Node.js websocket module in FortiOS and FortiProxy.
- Exploited in the wild
- Since 14 Jan 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55591?
CVE-2024-55591 is a critical authentication bypass vulnerability in Fortinet Fortios, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Weakness: CWE-288
Which versions are affected by CVE-2024-55591?
It affects 2 products.
Products include Fortinet Fortios, Fortinet Fortiproxy.
How do I fix CVE-2024-55591?
No fix has been published for CVE-2024-55591 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Jan 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-55591 being exploited?
Yes. Attackers have exploited CVE-2024-55591 in the wild since at least 14 Jan 2025, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 10 proofs of concept on GitHub.
Other vulnerabilities in Fortinet Fortios
- CVE-2024-23113 Fortinet Multiple Products Format String
- CVE-2022-40684 Fortinet Multiple Products Authentication Bypass
- CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write
- CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer Overflow
- CVE-2023-27997 Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow
Sources
Also known as GHSA-v4mr-pqhx-vpm2.