CVE-2024-55591: Authentication bypass in Node.js websocket module and CSF requests
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module or via crafted CSF proxy requests. Please note that reports show this is being exploited in the wild.
Other sources
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
— MITRE
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
— CISA
Affected Software
Remediation
Information
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-55591?
CVE-2024-55591 is considered critical due to its potential to allow remote attackers to gain super-admin privileges.
How do I fix CVE-2024-55591?
To fix CVE-2024-55591, update FortiOS to version 7.0.17 or higher, or FortiProxy to version 7.0.20 or higher.
Which versions of FortiOS are affected by CVE-2024-55591?
CVE-2024-55591 affects FortiOS versions from 7.0.0 to 7.0.16.
Which versions of FortiProxy are affected by CVE-2024-55591?
CVE-2024-55591 impacts FortiProxy versions from 7.2.0 to 7.2.12 and from 7.0.0 to 7.0.19.
Is there a known exploit for CVE-2024-55591?
Yes, CVE-2024-55591 is reported to be actively exploited against vulnerable systems.