Critical Vulnerability Affecting Fortinet FortiOS and FortiProxy
A critical vulnerability has been identified in Fortinet FortiOS and FortiProxy systems. Its exploitation could allow an unauthenticated remote cyberattacker to bypass access controls and execute administrative actions with super-administrator privileges on the management interface.
Description
Technical context and vulnerability details
Fortinet FortiOS is the secure operating system powering FortiGate next-generation firewalls, while FortiProxy is a dedicated proxy gateway for securing enterprise web traffic. These platforms handle application filtering, SSL inspection, and network segmentation within managed infrastructures.
These products are affected by the following vulnerabilities:
CVE-2024-55591: Critical authentication bypass vulnerability (CWE-287) within the Node.js WebSocket communication module of the administration interface. A remote attacker can craft unauthenticated WebSocket packets to gain super-administrator privileges. Classified Critical with a CVSS v3.1 base score of 9.8.
Potential Risks & Impact
Potential consequences upon exploitation
- Complete bypass of authentication and access control mechanisms;
- Unauthorized privilege escalation to super-administrator rights;
- Compromise of network configuration and secrets hosted on the device;
- Severe impact on the confidentiality, integrity, and availability of the security perimeter.
Affected systems
Products, components and targeted versions
- FortiOS 7.0: versions 7.0.0 to 7.0.16;
- FortiProxy 7.2: versions 7.2.0 to 7.2.12;
- FortiProxy 7.0: versions 7.0.0 to 7.0.19.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately upgrade FortiOS 7.0 to version 7.0.17 or higher;
- Upgrade FortiProxy to versions 7.2.13 or 7.0.20 or higher;
- Imperatively disable all public WAN exposure of the management interface (HTTPS/HTTP) and restrict administration solely to dedicated internal networks.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.