Article
Two Fortinet events of 2026: what to check
Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from…
Read more
Exploited vulnerability
FortiOS and FortiProxy authentication bypass (CVE-2024-55591)
CVE-2024-55591
CVE-2024-55591 is an authentication bypass flaw in FortiOS and FortiProxy.
- On CISA KEV
- CVE ID
- CVE-2024-55591
- CISA KEV
- Listed
- Affected product
- FortiOS and FortiProxy
- Exploited
- Yes
- Published
- January 2025
In short
CVE-2024-55591 is an authentication bypass flaw in FortiOS and FortiProxy. Fortinet says a remote attacker can gain super-admin privileges with crafted requests to the Node.js websocket module. CISA added it to its exploited vulnerabilities list on 14 January 2025, the same day Fortinet noted reports of exploitation in the wild.
- CVECVE-2024-55591
- ProductFortinet FortiOS and FortiProxy
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade to a fixed release · Hunt for signs of compromise
What it allows
A remote attacker with no login can send crafted requests to the device and gain super-admin rights. Super-admin is the highest level of control over a firewall or proxy, so the attacker can change its settings and create new administrator accounts. Fortinet's later update adds that crafted requests to the CSF proxy can also trigger the flaw.
Who is affected
Fortinet lists FortiOS 7.0.0 to 7.0.16, FortiProxy 7.2.0 to 7.2.12 and FortiProxy 7.0.0 to 7.0.19. Fortinet says FortiOS 7.6, 7.4, 7.2 and 6.4 are not affected. The National Vulnerability Database gives the same version ranges.
Fortinet published its advisory on 14 January 2025 and noted that reports show the flaw is being exploited in the wild. CISA added CVE-2024-55591 to the Known Exploited Vulnerabilities catalog the same day, with a due date of 21 January 2025 for US federal agencies.
The catalog marks known ransomware campaign use as Known. Fortinet's advisory lists log entries that may point to an attack, such as a super-admin login through the jsconsole interface and the creation of administrator accounts with randomly generated names.
What to do
-
Upgrade to a fixed release
Fortinet says to upgrade FortiOS 7.0 to 7.0.17 or above, FortiProxy 7.2 to 7.2.13 or above and FortiProxy 7.0 to 7.0.20 or above.
-
Limit the admin interface if you cannot patch
Fortinet's workaround is to disable the HTTP/HTTPS administrative interface, or to limit which IP addresses can reach it using local-in policies.
-
Hunt for signs of compromise
Fortinet lists log entries as possible indicators of compromise. Check for unexpected super-admin logins and newly created administrator accounts with random names.
-
Follow the CISA required action
CISA's catalog says to apply mitigations per vendor instructions, or stop using the product if mitigations are not available.
Questions
What is CVE-2024-55591?
CVE-2024-55591 is an authentication bypass in the Node.js websocket module of FortiOS and FortiProxy. A remote attacker with no login can send crafted requests and gain super-admin rights, the highest level of control over the device.
Which versions are affected by CVE-2024-55591?
Fortinet lists FortiOS 7.0.0 to 7.0.16, FortiProxy 7.2.0 to 7.2.12 and FortiProxy 7.0.0 to 7.0.19. FortiOS 7.6, 7.4, 7.2 and 6.4 are not affected. The National Vulnerability Database gives the same version ranges.
How do I fix CVE-2024-55591?
Upgrade FortiOS 7.0 to 7.0.17 or above, FortiProxy 7.2 to 7.2.13 or above, and FortiProxy 7.0 to 7.0.20 or above. If you cannot patch, disable the HTTP/HTTPS administrative interface or limit which IP addresses can reach it.
How can I tell if CVE-2024-55591 was used against my device?
Fortinet's advisory lists log entries that may point to an attack, such as a super-admin login through the jsconsole interface and the creation of administrator accounts with randomly generated names.
In our research
Sources
- FG-IR-24-535 Authentication bypass in Node.js websocket module Fortinet PSIRT
- NVD entry CVE-2024-55591 NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.