DaystoPatch

FortinetExploited incident

FortiOS and FortiProxy super-admin authentication bypass via Node.js websocket and CSF proxy

CVE-2024-55591, CVE-2025-24472Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 14 Jan 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 4 days after the first public report.
Embed this live clock

Response

Silence
4d
First public report to first vendor statement
Exposure
4d
First public report to first fix
Follow-through
4d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Arctic Wolf Labs: Console ChaosCuratedQuote verified

    While the initial access vector is not definitively confirmed, a zero-day vulnerability is highly probable.

    Post dated January 10, 2025. Arctic Wolf began observing the campaign in early December 2024 (activity from mid-November 2024), but published on January 10.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2dffd36164e8c0b3…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Fortinet advisory FG-IR-24-535ClaimedQuote verified14 Jan 2025

    Authentication bypass in Node.js websocket module and CSF requests

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-24-535 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:54bdd0f8c112226c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-55591)ClaimedQuote verified14 Jan 2025

    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2025-01-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-55591ClaimedQuote verified14 Jan 2025, 14:08 UTC

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:837b288c741fb707…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Jan 2025, 15:39 UTC

    CVE-2024-55591 A vulnerability (CWE-288) in FortiOS (7.0.0–7.0.16) and FortiProxy (7.0.0–7.0.19, 7.2.0–7.2.12) allows remote attackers to gain super-admin privileges by exploiting

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Jan 2025, 20:21 UTC

    Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls # CVE_2024_55591 https:// arcticwolf.com/resources/blog/

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet27 Jan 2025, 19:30 UTC

    https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-24472)ClaimedQuote verified18 Mar 2025

    Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

    Added to CISA's KEV catalog on 2025-03-18.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +4d

    CVE record CVE-2024-55591 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2025-01-14T14:08:34.207Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:837b288c741fb707…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Fortinet advisory FG-IR-24-535ClaimedQuote verified14 Jan 2025

    Authentication bypass in Node.js websocket module and CSF requests

    Source
    Fortinet advisory FG-IR-24-535 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:54bdd0f8c112226c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-24-535 (Wayback snapshot 2025-01-14 15:56 UTC)CuratedQuote verified14 Jan 2025

    2025-01-14: Initial publication

    The live advisory's timeline no longer shows this entry (its first entry is '2025-01-14: Format').

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42cac6b51482b0dc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date only+4d

    Fortinet PSIRT FG-IR-24-535 (Wayback snapshot 2025-01-14 15:56 UTC)CuratedQuote verified

    Disable HTTP/HTTPS administrative interface

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42cac6b51482b0dc…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet advisory FG-IR-24-535ClaimedQuote verified21 Jan 2025

    2025-01-21: Added IPS package info

    CaveatRevision mentions a workaround or mitigation; it may have existed earlier.

    Source
    Fortinet advisory FG-IR-24-535 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a39ee9c09d8269b9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    date only+4d

    Fortinet PSIRT FG-IR-24-535 (Wayback snapshot 2025-01-14 15:56 UTC)CuratedQuote verified

    Upgrade to 7.0.17 or above

    FortiOS 7.0.17 and FortiProxy 7.0.20/7.2.13 were listed as fixed (none 'upcoming') on the first day. Whether those builds shipped before the advisory was not verified. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:42cac6b51482b0dc…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+4d

    Fortinet PSIRT FG-IR-24-535CuratedQuote verified

    Upgrade to 7.0.20 or above

    All three affected branches (FortiOS 7.0, FortiProxy 7.2, FortiProxy 7.0) fixed in the first-day advisory; CVE-2025-24472, added on 2025-02-11, has the same fixed versions.

    Source
    Fortinet PSIRT FG-IR-24-535 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f34128b847d5dbc2…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

FortiOS 7.0 firewalls hit by an authentication bypass, fixed in 7.0.17

Attackers used a zero-day in FortiOS 7.0 and FortiProxy to become super-admin on firewalls with exposed management interfaces before Fortinet published fixes on 14 January 2025.

In plain words

Fortinet firewalls running the 7.0 software line had a flaw that let outsiders become full administrators through the management web page, and attackers used it for weeks before a fix was published on 14 January 2025, later including ransomware groups. If we run FortiOS 7.0 or FortiProxy, we need to be on 7.0.17 or later (or the FortiProxy equivalents) and make sure the management page is not open to the internet.

What happened and who is affected

What happened

From November 2024 attackers created admin accounts and VPN users on FortiGate firewalls whose management interface faced the internet; Arctic Wolf reported the campaign on 10 January 2025. On 14 January 2025 Fortinet disclosed CVE-2024-55591, an authentication bypass in the Node.js websocket module, confirmed exploitation and listed fixed releases and a workaround. In February 2025 it added a second path, CVE-2025-24472 (CSF proxy requests), fixed by the same releases; ransomware operators later used these flaws.

Who is affected

FortiOS 7.0.0 through 7.0.16, FortiProxy 7.2.0 through 7.2.12 and FortiProxy 7.0.0 through 7.0.19. Other FortiOS branches are not affected.

CVE-2024-55591, CVE-2025-24472. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2024-55591/

Affected products

  • FortiOS 7.0
  • FortiProxy 7.2
  • FortiProxy 7.0
How we built this timeline

Grouping: CVE-2025-24472 was added to the same advisory on 11 Feb 2025 (KEV 18 Mar 2025, ransomware use Known; Forescout linked it to SuperBlack ransomware, not fetched here). kev_added is the earlier CVE-2024-55591 date.

Arctic Wolf's campaign timeline: scanning from 16 Nov 2024, malicious activity through late December 2024. Live advisory timeline was rewritten: it lists '14 Jan 2025: Format', 15 Jan 2025 additions, IPS package info added 21 Jan 2025 and removed 24 Jan 2025, CVE-2025-24472 added 11 Feb 2025, IoCs added 31 Mar 2025.

Fortinet CVSSv3 9.8 (live page).

Related

No related incidents.

Fortinet report card