Fortinet · FortiOS and FortiProxy
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
What it is
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
CISA: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: January 21, 2025
- Added to the CISA list
- January 14, 2025
- Published
- January 14, 2025
- Severity
- Critical 9.6 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 94% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-288
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 18, 2025 | Authentication Bypass | FortiOS and FortiProxy | High 8.1 | 7.2% |
| Jan 10, 2022 | Improper Authorization | FortiOS and FortiProxy | Critical 9.1 | 82% |
| Jan 10, 2022 | Out-of-bounds Write | FortiOS and FortiProxy | Medium 4.3 | 34% |
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
| Jul 16, 2026 | OS Command Injection | FortiSandbox | Critical 9.1 | 76% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.