An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

The instance of Fortinet FortiOS or FortiProxy running on the remote host is affected by an authentication bypass vulnerability (CWE-288) via crafted Node.js WebSocket requests or CSF proxy requests:

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0     through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain     super-admin privileges via crafted requests to Node.js websocket module. (CVE-2024-55591)

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0     through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain     super-admin privileges via crafted CSF proxy requests. (CVE-2025-24472)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-535 advisory.

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS     7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote attacker     to gain super-admin privileges via crafted CSF proxy requests. (CVE-2025-24472)

  - An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS     version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a     remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
    (CVE-2024-55591)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
324976	Fortinet FortiOS / FortiProxy Authentication Bypass via WebSocket (CVE-2024-55591, CVE-2025-24472)	Nessus	CGI abuses	critical
214072	Fortinet Fortigate Authentication bypass in Node.js websocket module and CSF requests (FG-IR-24-535)	Nessus	Firewalls	critical

Detections

Analytics

CVE-2025-24472

high

Tenable Plugins

critical

critical