CVE-2024-55591 - Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet | FortiOS and FortiProxy

• Date Added:
• 2025-01-14

• Due Date:
• 2025-01-21

Vulnerability Name

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Description

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55591

Related News Articles

15K Fortinet Device Configs Leaked to the Dark WebJanuary 18, 2025

Fortinet Warns of New Zero-Day Used in Attacks on Firewalls with Exposed InterfacesJanuary 14, 2025