Back to KEVs

CVE-2024-55591

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy...

Basic Information

CVE State
PUBLISHED
Reserved Date
December 09, 2024
Published Date
January 14, 2025
Last Updated
January 23, 2025
Vendor
Fortinet
Product
FortiOS, FortiProxy
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Tags
nodejs ios cisa malware ransomware edge nuclei_scanner

CVSS Scores

CVSS v3.1

9.6 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-01-14 00:00:00 UTC) Source
Proof of Concept Available
Yes (added 2025-01-22 14:16:30 UTC) Source
Used in Malware
Yes (added 2025-01-14 00:00:00 UTC) Source

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-535

Known Exploited Vulnerability Information

Source Added Date
CISA 2025-01-14 00:00:00 UTC

Recent Mentions

Fortinet has observed threat actors exploiting CVE-2025-32756, a critical zero-day arbitrary code execution vulnerability which affects multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera.BackgroundOn May 13th, Fortinet published a security advisory (FG-IR-25-254) for CVE-2025-32756, a critical arbitrary code execution vulnerability affecting multiple Fortinet products.CVEDescriptionCVSSv3CVE-2025-32756An arbitrary code execution vulnerability in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera9.6AnalysisCVE-2025-32756 is an arbitrary code execution vulnerability affecting multiple Fortinet products including FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera. A remote unauthenticated attacker can send crafted HTTP requests in order to create a stack-based overflow condition which would allow for the execution of arbitrary code. This vulnerability was discovered by the Fortinet Product Security Team who observed threat activity involving a device running FortiVoice.According to Fortinet, the threat actors operations included scanning the network, erasing system crashlogs and enabling ‘fcgi debugging’ which is used to log authentication attempts, including SSH logins. The ‘fcgi debugging’ option is not enabled by default and the Fortinet advisory recommends reviewing the setting as one possible indicator of compromise (IoC).Historical Exploitation of Fortinet DevicesFortinet vulnerabilities have historically been common targets for cyber attackers, and CVE-2025-32756 is the eighteenth Fortinet vulnerability to be added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list.CVEDescriptionPatchedTenable BlogCVE-2024-55591Fortinet Authentication Bypass in FortiOS and FortiProxyJanuary 2025CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the WildCVE-2024-21762Fortinet FortiOS Out-of-bound Write Vulnerability...

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55591.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

exfil0/CVE-2024-55591-POC

Type: github • Created: 2025-01-29 14:54:40 UTC • Stars: 10

A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-2024-55591) in certain Fortinet devices.

watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591

Type: github • Created: 2025-01-27 06:25:53 UTC • Stars: 52

virus-or-not/CVE-2024-55591

Type: github • Created: 2025-01-24 20:29:56 UTC • Stars: 5

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

sysirq/fortios-auth-bypass-exploit-CVE-2024-55591

Type: github • Created: 2025-01-22 14:16:30 UTC • Stars: 3

sysirq/fortios-auth-bypass-poc-CVE-2024-55591

Type: github • Created: 2025-01-21 12:30:21 UTC • Stars: 23

watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591

Type: github • Created: 2025-01-16 07:26:15 UTC • Stars: 65

Timeline

  • CVE ID Reserved

  • Exploit Used in Malware

  • Added to KEVIntel

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Detected by Nuclei