CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Description
CVE-2024-55591 is a critical authentication bypass vulnerability in Fortinet FortiOS and FortiProxy products. Exploiting a flaw in the Node.js websocket module, a remote unauthenticated attacker can gain super-admin privileges on affected FortiGate firewalls and FortiProxy appliances by sending crafted requests. Rated CVSS v3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this vulnerability affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. CISA has added it to the KEV catalog with a remediation deadline of January 21, 2025, with confirmed ransomware exploitation. The EPSS score of 0.94197 (99.9th percentile) indicates near-certain exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 7.0.0, < 7.0.20; >= 7.2.0, < 7.2.13 |
| fortinet | fortios | >= 7.0.0, < 7.0.17 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-535(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2024-55591 is classified under CWE-288, which describes a vulnerability where a product's authentication mechanism can be circumvented by accessing the system through an alternate path or communication channel that does not enforce the same authentication requirements. In the case of FortiOS and FortiProxy, the Node.js websocket module provides an alternate communication channel to the management interface. The websocket endpoint fails to properly enforce authentication controls, allowing an unauthenticated remote attacker to send crafted requests through this channel to bypass the standard login process entirely. By exploiting this alternate path, the attacker gains super-admin privileges without providing any credentials, achieving complete administrative control over the device. Learn more about CWE-288
Impact Analysis
Complete Network Perimeter Compromise is the immediate consequence of exploiting CVE-2024-55591. FortiGate firewalls and FortiProxy appliances sit at the network boundary, controlling all traffic between internal networks and the internet. An attacker who gains super-admin access to these devices effectively controls the organization's network perimeter.
Confidentiality Impact is maximum (C:H). Super-admin access to a FortiGate firewall provides the attacker with access to all firewall configurations, VPN credentials, SSL inspection keys, traffic logs, and the ability to intercept all network traffic passing through the device. The attacker can extract VPN user databases, read encrypted traffic through SSL inspection certificate access, and harvest credentials from authentication integrations.
Integrity Impact is maximum (I:H). With super-admin privileges, the attacker can modify firewall rules to permit unrestricted inbound access, disable security inspection features, create backdoor VPN accounts, alter routing configurations to redirect traffic through attacker-controlled infrastructure, and modify logging settings to conceal their activities. The attacker effectively becomes the gatekeeper of the organization's network.
Availability Impact is maximum (A:H). The attacker can disable the firewall entirely, block legitimate traffic, disrupt VPN connectivity for remote workers, or brick the device through malicious firmware updates. For organizations dependent on FortiGate for branch office connectivity, this can sever business operations across multiple locations.
Ransomware Connection: CISA explicitly confirms this vulnerability has "Known" ransomware exploitation. The 99.9th percentile EPSS score of 0.94197 reflects near-universal adoption by threat actors. Ransomware groups use compromised FortiGate devices to establish persistent network access, disable security controls, and deploy ransomware across the internal network through the firewall's trusted position.
Exploit Maturity
CVE-2024-55591 represents one of the most actively exploited vulnerabilities in the current threat landscape. CISA's KEV catalog lists it with a remediation deadline of January 21, 2025, and the EPSS score of 0.94197 (99.9th percentile) places it among the top 0.1% of all vulnerabilities by exploitation activity.
Confirmed Ransomware Exploitation: CISA classifies the ransomware association as "Known," meaning ransomware groups have been observed actively using this vulnerability in their attack campaigns. FortiGate firewalls are prime targets for ransomware operators because compromising the network perimeter device provides trusted access to the entire internal network, bypassing all perimeter security controls.
Trivial Remote Exploitation: The CVSS vector reflects the most dangerous possible exploitation profile: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). An attacker can exploit this vulnerability remotely against any internet-facing FortiGate or FortiProxy management interface by sending crafted requests to the Node.js websocket module. No credentials, social engineering, or complex exploitation chains are required.
Vendor Advisory and Patches: Fortinet has published a security advisory FG-IR-24-535 with detailed mitigation guidance and patched firmware versions. The advisory confirms the vulnerability mechanism involves the Node.js websocket module and provides indicators of compromise for detecting exploitation.
Mass Exploitation Campaigns: The combination of trivial remote exploitation, maximum impact, and the strategic value of firewall compromise has made this a priority target for both nation-state actors and financially motivated threat groups. Organizations with internet-exposed FortiGate management interfaces should assume compromise if patching was not applied promptly after disclosure.
Remediation
-
Upgrade FortiOS and FortiProxy firmware immediately to patched versions. FortiOS must be updated to version 7.0.17 or later, FortiProxy to version 7.0.20 or later (7.0.x branch) or 7.2.13 or later (7.2.x branch). Review the Fortinet advisory FG-IR-24-535 for the exact patched firmware versions and upgrade instructions specific to your deployment.
-
Restrict management interface access as an emergency mitigation if firmware upgrades cannot be applied immediately. Disable access to the FortiGate and FortiProxy management interfaces from the internet. Use local-in policies to restrict management access to trusted internal IP addresses only. Disable the HTTP/HTTPS management interface on WAN-facing interfaces entirely.
-
Audit for indicators of compromise across all FortiGate and FortiProxy devices in your environment. Review admin account lists for unauthorized super-admin accounts, check system logs for unusual websocket connections and administrative actions, examine firewall policy changes made during the vulnerable period, and inspect VPN configurations for unauthorized accounts or certificates.
-
Rotate all credentials and certificates on affected FortiGate and FortiProxy devices after patching. Change all local admin passwords, regenerate SSL inspection certificates, rotate VPN pre-shared keys and certificates, invalidate and reissue RADIUS/LDAP integration credentials, and reset API keys. Assume that any secrets stored on or accessible through the device have been compromised.
-
Implement network segmentation and monitoring to limit the blast radius of potential compromise. Place FortiGate management interfaces on a dedicated out-of-band management network. Deploy network detection and response tools to monitor for lateral movement from compromised perimeter devices. Enable enhanced logging and forward logs to a SIEM that the FortiGate cannot access or modify.
Technical Details
CVE-2024-55591 is a critical authentication bypass vulnerability in Fortinet FortiOS and FortiProxy products that allows unauthenticated remote attackers to gain super-admin privileges through the Node.js websocket module.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces the near-maximum base score of 9.8. Network attack vector (AV:N) means exploitation is possible from anywhere on the internet. Low complexity (AC:L) indicates reliable, deterministic exploitation. No privileges (PR:N) and no user interaction (UI:N) mean the attack is fully autonomous. The unchanged scope (S:U) and maximum impact ratings (C:H/I:H/A:H) reflect complete device takeover.
Attack Mechanism: FortiOS and FortiProxy include a Node.js-based websocket module as part of their web management interface. This websocket endpoint accepts connections and processes requests that interact with the device's administrative functions. CVE-2024-55591 exploits a flaw in this websocket module where authentication checks are improperly implemented, allowing an attacker to craft specific websocket requests that are processed with super-admin authority without requiring any authentication credentials. The attacker can then create new admin accounts, modify device configurations, access VPN credentials, and perform any administrative action as if they were a fully authenticated super-admin.
Affected Versions and Products: FortiOS versions 7.0.0 through 7.0.16 are vulnerable, requiring upgrade to 7.0.17 or later. FortiProxy 7.0.0 through 7.0.19 requires upgrade to 7.0.20 or later, and FortiProxy 7.2.0 through 7.2.12 requires upgrade to 7.2.13 or later. Importantly, only the 7.0 branch of FortiOS is affected — FortiOS 6.x and 7.2+ branches are not vulnerable to this specific flaw.
Strategic Value of the Target: FortiGate firewalls are among the most widely deployed network security appliances globally, protecting enterprise networks, government agencies, and critical infrastructure. Their position at the network perimeter gives them visibility and control over all traffic entering and leaving the network. Compromising a FortiGate device gives an attacker a trusted position from which to pivot into the internal network, intercept traffic, and disable security controls — making this vulnerability exceptionally valuable for both espionage and destructive attack campaigns.
Frequently Asked Questions
What is CVE-2024-55591?
CVE-2024-55591 is a critical authentication bypass vulnerability in Fortinet FortiOS (7.0.0-7.0.16) and FortiProxy (7.0.0-7.0.19, 7.2.0-7.2.12). It allows an unauthenticated remote attacker to gain super-admin privileges by sending crafted requests to the Node.js websocket module. The vulnerability has a CVSS score of 9.8 and is actively exploited by ransomware groups.
Is my FortiGate vulnerable to CVE-2024-55591?
Your FortiGate is vulnerable if it runs FortiOS 7.0.0 through 7.0.16. FortiOS versions in the 6.x and 7.2+ branches are not affected by this specific vulnerability. For FortiProxy, versions 7.0.0-7.0.19 and 7.2.0-7.2.12 are vulnerable. Check your firmware version in the FortiGate dashboard or via CLI with "get system status."
Can CVE-2024-55591 be exploited if my management interface is not internet-facing?
The risk is significantly reduced but not eliminated if the management interface is accessible only from internal networks. An attacker who has gained initial access to your internal network through other means (phishing, VPN compromise, etc.) could still exploit this vulnerability to compromise the FortiGate. However, removing internet-facing management access is the most effective interim mitigation.
Has this vulnerability been used in ransomware attacks?
Yes. CISA explicitly classifies the ransomware exploitation status as "Known," confirming that ransomware groups have incorporated CVE-2024-55591 into their attack campaigns. Compromised FortiGate devices provide attackers with trusted network access, making them ideal staging points for deploying ransomware across the internal network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.