ZeroDay Findings
Sign inSign up

Findings

CVE-2024-55591

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Published Jan 14, 2025 · updated Aug 4, 2026 · fortinet fortiproxy

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2025 · Catalog

    Detected

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

  2. Jan 14, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Jan 21, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Aug 4, 2026 · Catalog

    Updated

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Jan 21, 2025

Affected

  • cpe fortinet/fortiosversion unspecified
  • cpe fortinet/fortiproxyversion unspecified
  • vendor Fortinet FortiOS and FortiProxyversion unspecified

Sources

  • CISA KEVCVE-2024-55591

    Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

    cisa.gov
  • CVE.orgCVE-2024-55591

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-55591

    30-day exploitation probability 94.1%

    first.org
  • NIST NVDCVE-2024-55591

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to

    nvd.nist.gov

References