9.6Critical KEV Used in ransomware

CVE-2024-55591Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet FortiOS; Fortinet FortiProxy Published: 2025-01-14 17:08 (1 year ago)

Known exploited — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CISA confirmed this vulnerability is used in real attacks on 14.01.2025. Remediation deadline for US federal agencies: 21.01.2025.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55591

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Weakness (CWE): CWE-288

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Fortinet	FortiOS	7.0.0 – ≤ 7.0.16
Fortinet	FortiProxy	7.2.0 – ≤ 7.2.12, 7.0.0 – ≤ 7.0.19

References and patches

https://fortiguard.fortinet.com/psirt/FG-IR-24-535 MitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591 US Government Resource

CPE matches (NVD) (3)

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.20
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.13
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.17

CVSS score

9.6Critical

Source: fortinet · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

All scores (3)

cna	CVSS 3.1	9.6Critical
psirt@fortinet.com	CVSS 3.1	9.8Critical
nvd	CVSS 3.1	9.8Critical

EPSS (chance of exploitation in 30 days)

94.35%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2024-12-09
Published2025-01-14 17:08
Reached IP-DB2026-10-24 23:30
Added to KEV2025-01-14
Last updated2026-08-05 08:16

Assigned by (CNA): fortinet
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Known exploited — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Description

Affected products and versions

References and patches

CPE matches (NVD) (3)

Recent CVEs in the same product — Fortinet (all products)