Patchfirst
Patchfirst
CVE-2024-55591 KEVRansomwarePublic exploit Critical · 9.8 EPSS 94.3%

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Fortinet · FortiOS and FortiProxy

Summary

A flaw in the Node.js websocket module of Fortinet FortiOS (7.0.0 through 7.0.16) and FortiProxy (7.0.0 through 7.0.19 and 7.2.0 through 7.2.12) lets an authentication bypass occur via an alternate path or channel. A remote attacker who can reach the affected device, needing no credentials or user interaction, can send crafted requests to that websocket module to gain super-admin privileges.

Official description · NVD

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Breakdown
83.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
6/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

  3. What can follow

First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.

  1. DisclosedFirst seen exploitedVulnCheck KEV evidenceAdded to CISA KEVknown ransomware use; EU database agreesday 0
  2. Public exploit codePoC-in-GitHub+2 days
  3. Named in a threat reportctrlaltintel.com+14 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Valid Accounts T1078 also Persistence, Privilege Escalation, Stealth
MITRE CTID mapping of the KEV entry · primary impact

An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068
MITRE CTID mapping of the KEV entry · how it is exploited

Credential AccessTA0006

Credentials from Password Stores T1555
MITRE CTID mapping of the KEV entry · primary impact

Lateral MovementTA0008

Remote Services T1021
MITRE CTID mapping of the KEV entry · follow-on activity

Detection

0 rules for this CVE · 106 general rules for its techniques

Rules for this CVE

0 that reference CVE-2024-55591 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploitation for Privilege EscalationT106831 general rules
All 31 on SigmaHQ ↗
Valid AccountsT107856 general rules
All 56 on SigmaHQ ↗
Credentials from Password StoresT15558 general rules
Remote ServicesT102111 general rules
All 11 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportctrlaltintel.comMar 2026

Reports are matched by finding the exact id CVE-2024-55591 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Vendor Advisory 1

fortiguard.fortinet.com/psirt/FG-IR-24-535

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591
↑ ↓ chooseEnter openEsc close