⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2025-01-21.
CVE-2024-55591 — Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortios
Severity
9.8CRITICALNVD
EPSS
94.2%
top 0.08%
CISA KEV
KEVRansomware
Added 2025-01-14
Due 2025-01-21
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJan 14
KEV addedJan 14
KEV dueJan 21
Latest updateMar 13
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages4 packages
🔴Vulnerability Details
3💥Exploits & PoCs
1Nuclei▶
Fortinet - Authentication Bypass
🔍Detection Rules
1Suricata▶
ET WEB_SPECIFIC_APPS Fortinet Authentication Bypass via Node.js Websocket (CVE-2024-55591)↗2025-01-16
📋Vendor Advisories
2🕵️Threat Intelligence
5Threat Intel▶
Mora_001
Threat Intel▶
Belsen Group