Updated:
Status:
CVEs:
Fortra is actively researching a critical authentication bypass vulnerability CVE-2024-55591 in the Node.js websocket module affecting FortiOS firewalls and FortiProxy web gateways. This vulnerability affects FortiOS firewalls and FortiProxy web gateways and has been exploited as a zero-day by attackers to compromise publicly-exposed FortiGate firewalls.
Who is affected?
The following platforms are impacted by this vulnerability:
FortiOS 7.0.0 through 7.0.16
FortiProxy 7.20 through 7.2.12
FortiProxy 7.00 through 7.0.19
What can I do?
Fortinet has released security patches to address this vulnerability. Customers should install and upgrade to the latest patched versions as soon as possible:
FortiOS 7.0 – Upgrade to 7.0.17 or above
FortiProxy 7.2 – Upgrade to 7.2.13 or above
FortiProxy 7.0 – Upgrade to 7.0.20 or above
Fortinet has detailed a workaround in its advisory. Refer to the official vendor advisory for more details on mitigation steps.
How is Fortra helping me?
Fortra is actively researching this threat to build detection capabilities in addition to those listed below:
Log Management: Alert Logic Deployed Log Telemetry for FortiOS Admin User Creation on January 15th.
Alert Logic Vulnerability Scanning: Alert Logic released authenticated network scan detection for FortiOS released on January 16th.
IDS: On January 23, 2025, IDS rule released to detect Fortinet Authentication bypass via Node.js Websocket.
Tripwire IP360: Tripwire released scan coverage on January 29, 2025, to identify vulnerable instances. The following table identifies matching vulnerabilities.
| CVE | Tripwire IP360 Vulnerabilities |
| CVE-2024-55591 | 694290 |
- FortraVM: On February 12, 2025, FortraVM has completed an unauthenticated network scan detection for FortiOS.
Updates
Fortra has kicked off the Emerging Threats process for this vulnerability. This article will be updated with new information about this vulnerability and related security coverage as it becomes available.
01/15/2025: Alert Logic deployed log telemetry for FortiOS admin user creation.
01/16/2025: Alert Logic introduced authenticated network scan detection for FortiOS.
01/23/2025: IDS rule released to detect Fortinet Authentication bypass via Node.js WebSocket.
01/29/2025: Tripwire released scan coverage to detect vulnerable FortiOS instances.
02/12/2025: FortraVM has completed unauthenticated network scan detection for FortiOS.
