{"id":"CVE-2024-55591","published":"2025-01-14T14:15:34Z","modified":"2026-08-05T05:16:42Z","title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","vendor":"Fortinet","product":"FortiOS and FortiProxy","tier":"core","eol":null,"description":{"text":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the Node.js websocket module of Fortinet FortiOS (7.0.0 through 7.0.16) and FortiProxy (7.0.0 through 7.0.19 and 7.2.0 through 7.2.12) lets an authentication bypass occur via an alternate path or channel. A remote attacker who can reach the affected device, needing no credentials or user interaction, can send crafted requests to that websocket module to gain super-admin privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:58:13Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9435,"percentile":0.9985,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-01-14","dueDate":"2025-01-21","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55591","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-01-14","exploitedFirstSeen":"2025-01-14","ransomware":true,"evidence":[{"url":"https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/","date":"2025-01-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-01-14"},{"url":"https://www.rapid7.com/blog/post/2025/01/16/etr-fortinet-firewalls-hit-with-new-zero-day-attack-older-data-leak/","date":"2025-01-16"},{"url":"https://censys.com/fortigate-config-leak-impact/","date":"2025-01-17"},{"url":"https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/","date":"2025-01-27"},{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535","date":"2025-02-11"},{"url":"https://attackerkb.com/topics/5K4caFRSPo/cve-2024-55591#exploited-in-the-wild_9c3c0bdd-7a98-48de-a889-f351a2aec7cf","date":"2025-03-12"},{"url":"https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/","date":"2025-03-12"},{"url":"https://www.esentire.com/blog/from-access-to-encryption-dissecting-hunters-internationals-latest-ransomware-attack","date":"2025-03-19"},{"url":"https://www.cert.at/de/warnungen/2025/3/ransomware-gruppen-nutzen-weiterhin-kritische-fortinet-schwachstellen-warnung-vor-gepatchten-aber-bereits-kompromittierten-geraten","date":"2025-03-20"}],"evidenceTotal":91,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.","confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.","confidence":"high"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.","confidence":"high"},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"An attacker can add a local_access_token parameter to a request targeting a specific endpoint on vulnerable Fortinet devices, leading to an authentication bypass. From there, they can obtain super_admin privileges.","confidence":"high"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2024-55591 - Fortinet FortiOS authentication bypass","start":4418,"end":4473},{"quote":"We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.","start":6650,"end":6821}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-52819","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52819","exploited":true,"exploitedSince":"2025-01-14","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":9,"skipped":1,"earliest":"2025-01-16","earliestUrl":"https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","repos":[{"name":"watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591","url":"https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591","stars":76,"created":"2025-01-27"},{"name":"watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","url":"https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","stars":65,"created":"2025-01-16"},{"name":"sysirq/fortios-auth-bypass-poc-CVE-2024-55591","url":"https://github.com/sysirq/fortios-auth-bypass-poc-CVE-2024-55591","stars":27,"created":"2025-01-21"},{"name":"exfil0/CVE-2024-55591-POC","url":"https://github.com/exfil0/CVE-2024-55591-POC","stars":12,"created":"2025-01-29"},{"name":"virus-or-not/CVE-2024-55591","url":"https://github.com/virus-or-not/CVE-2024-55591","stars":8,"created":"2025-01-24"}]},"nuclei":[{"id":"CVE-2024-55591","name":"Fortinet - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-55591.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-55591.yaml"}],"first":{"date":"2025-01-16","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1078","T1555"],"provenance":"source"},{"stage":"secondary","techniques":["T1021"],"provenance":"source"}],"timeline":[{"date":"2025-01-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55591","provenance":"source"},{"date":"2025-01-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/","provenance":"source"},{"date":"2025-01-14","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52819","provenance":"source"},{"date":"2025-01-16","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 654 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"9 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}