Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2024-55591 9.8
Fortinet · FortiOS and FortiProxy · Added 2025-01-14 · Published 2025-01-14
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityFortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
VendorFortinet
ProductFortiOS and FortiProxy
Date added2025-01-14
Due date2025-01-21
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWECWE-288
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

NVD: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-09-07 18:43 UTC
Wall time0.4s
Searches5
Component defaultyes
Sources https://www.fortiguard.com/psirt/FG-IR-24-535
https://nvd.nist.gov/vuln/detail/CVE-2024-55591
https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591
https://github.com/exfil0/CVE-2024-55591-POC
https://github.com/virus-or-not/CVE-2024-55591
https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/
https://hackmag.com/security/fortios-bypass
https://www.fortra.com/security/emerging-threats/fortios-fortiproxy-authentication-bypass-nodejs-websocket-module
https://www.avertium.com/flash-notices/cve-2024-55591-actively-exploited-patch-and-manage

Hunting hypothesis agent

Hunt WebSocket upgrades to /ws/cli/open?local_access_token= from external IPs and super_admin login contexts on Telnet port 8023 -- FortiOS node logs showing 'CLI connection established' without prior auth failure reveal the race bypass

Research details

ComponentNode.js websocket module
PreconditionsThe attacker must have network reachability to the FortiOS or FortiProxy management interface (HTTPS, typically on ports 443 or 8443). The Node.js websocket module must be accessible, which is the default configuration when the HTTPS administrative interface is enabled. The attacker needs to know at least one valid admin account username; common default usernames such as 'admin' can be used or brute-forced. The target must be running a vulnerable version: FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, or FortiProxy 7.2.0 through 7.2.12. The attacker sends crafted WebSocket upgrade requests to endpoints such as /ws/cli/ with a local_access_token parameter to bypass authentication and establish a privileged CLI session as super-admin. agent
DeliveryThe exploit chains four issues: (1) a WebSocket connection can be created from a pre-authenticated HTTP request; (2) the local_access_token query parameter bypasses session validation in _getAdminSession(); (3) a race condition in the WebSocket-to-Telnet proxy allows the attacker to send a forged login context string (format: "<user>" "admin" "<user>" "super_admin" "<user>" "<user>" [<ip>]:<port>) before the server sends its own; (4) the login context contains no cryptographic material -- the attacker chooses super_admin profile. The PoC brute-forces WebSocket connections while sending the login context immediately after upgrade, targeting /ws/cli/open?cols=162&rows=100&local_access_token=<any_value>. Pre-flight validation uses GET /service-worker.js?local_access_token=<value> checking for 'api/v2/static' in response.
Public PoCyes
PoC URLs https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591
https://github.com/exfil0/CVE-2024-55591-POC
https://github.com/virus-or-not/CVE-2024-55591 Third-party repos; verify before use.
Advisoryhttps://www.fortiguard.com/psirt/FG-IR-24-535
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8). The watchTowr PoC (CVE-2024-55591-PoC.py) brute-forces WebSocket upgrade requests to /ws/cli/open with local_access_token=<value> to bypass session checks, then races the server's Telnet login by sending a forged login context with super_admin profile. The race window is between WebSocket upgrade and the server sending the "Connected." greeting. Multiple public PoCs (watchtowrlabs, exfil0, virus-or-not). Actively exploited in the wild since late 2024; Arctic Wolf documented threat actors creating admin accounts via this exact technique. The local_access_token parameter is the key bypass -- any non-empty value triggers the vulnerable code path in _getAdminSession().
SummaryCVE-2024-55591 is a critical authentication bypass in FortiOS and FortiProxy (versions 7.0.0-7.0.16, FortiProxy 7.0.0-7.0.19 and 7.2.0-7.2.12) that chains a WebSocket pre-authentication path, a local_access_token session bypass, and a race condition in the Telnet CLI proxy to grant unauthenticated super-admin access. An attacker sends a WebSocket upgrade to /ws/cli/open with any local_access_token value, then races the server's login by injecting a forged login context with super_admin privileges before the server authenticates. Actively exploited in the wild by multiple threat actors since late 2024.

Tia coverage

First reported2026-07-11

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-urges-organizations-to-patch-exposed-vpns-and-segment-netwojoint-us-south-korea-advisory-gunra-ransomware-exploits-fortinetthe-gentlemen-ransomware-storm-2697-fastest-growing-raas-of-2026

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub