Fortinet patched a zero day authentication bypass vulnerability in FortiOS and FortiProxy that has been actively exploited in the wild as a zero-day since November 2024.

CVE-2024-55591: Fortinet Authentication Bypass Zero-Day Vulnerability Exploited in the Wild

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Exploitation in the wild has been observed according to the Fortinet Advisory. Immediate patching is recommended and mitigation steps are available.

FortiOS version 7.0.x prior to 7.0.16 and FortiProxy version 7.0.x prior to 7.0.19 or 7.2.x prior to 7.2.12 are affected by a vulnerability allowing allows a remote attacker to gain super-admin privileges via a specific crafted requests.

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-535 advisory.

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS     7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote attacker     to gain super-admin privileges via crafted CSF proxy requests. (CVE-2025-24472)

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS     version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a     remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
    (CVE-2024-55591)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114777	FortiOS 7.0.x < 7.0.16 Authentication Bypass	Web App Scanning	Component Vulnerability	critical
214072	Fortinet Fortigate Authentication bypass in Node.js websocket module and CSF requests (FG-IR-24-535)	Nessus	Firewalls	critical

Detections

Analytics

CVE-2024-55591

critical

Tenable Plugins

critical

critical