CVE-2024-55591

Fortinet · Published January 14, 2025

9.8

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Fortinet FortiOS and FortiProxy authentication bypass via crafted Node.js WebSocket module messages allowing an attacker to gain super-admin privileges. Massively exploited in the wild creating rogue admin accounts.

Affected Products

FortiOS 7.0.0-7.0.16
FortiProxy 7.0.0-7.0.19
FortiProxy 7.2.0-7.2.12

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Related Advisories

CVECRITICALCVE-2024-55591

FortiOS Auth Bypass (CVE-2024-55591) Massively Exploited — Rogue Admin Accounts Created

Fortinet's critical authentication bypass in FortiOS and FortiProxy management interfaces is being actively exploited at scale, with attackers creating hidden super-admin accounts and pivoting to internal networks.

WHY IT MATTERS

Threat actors are creating rogue admin accounts within hours of FortiGate exposure — check your firewall management interface access logs now.

FortinetFortiGateRemote Code Execution+2 more

Jan 14, 2025· 4 min read