Critical · published January 14, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 An unsuspecting websocket can turn your FortiOS into a playground for attackers! A single crafted request is all it takes to bypass authentication completely and gain super-admin privileges! 🔥 Think of it like a secret entrance to a VIP lounge that bypasses the bouncer. An attacker can stroll right in without a valid ticket, enjoying all the exclusive perks without any authorization checks! This vulnerability is absolutely devastating — an attacker exploiting it could gain unrestricted access to your network and sensitive data. With super-admin privileges, they can modify settings, steal information, or even disable your security measures completely. The consequences could be catastrophic!
Think of it like a secret entrance to a VIP lounge that bypasses the bouncer. An attacker can stroll right in without a valid ticket, enjoying all the exclusive perks without any authorization checks! CVE-2024-55591 allows remote attackers to bypass authentication via crafted requests to the Node.js websocket module, affecting FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12.
This vulnerability is absolutely devastating — an attacker exploiting it could gain unrestricted access to your network and sensitive data. With super-admin privileges, they can modify settings, steal information, or even disable your security measures completely. The consequences could be catastrophic! Immediate action is paramount! Patch your systems to the latest version — FortiOS to 7.0.17 or higher, and FortiProxy to 7.0.20 or higher. Additionally, review your access controls and monitor logs for any suspicious activity. Don't wait! You’ve got this! Just follow these steps and secure your system like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/fortiproxy | ≥ 7.0.0, < 7.0.20 | 7.0.20 |
| fortinet/fortiproxy | ≥ 7.2.0, < 7.2.13 | 7.2.13 |
| fortinet/fortios | ≥ 7.0.0, < 7.0.17 | 7.0.17 |