Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

CVE-2024-55591

Known ransomware campaign use. CISA's KEV catalog lists this CVE as used in ransomware attacks.
CISA KEV
Exploited
Ransomware Use
CVSS 3.1 Score
9.8
CRITICAL
EPSS Score
94.15%
EPSS Percentile
99.8%
as of 2026-10-05
NVD Status
Analyzed
Published 2025-01-14
Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Affected Vendors / Products
Fortinet Fortiproxy
Fortinet Fortios
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-288NVD-CWE-Other
Last Modified
2026-08-05
CVSS 3.1 Vector Breakdown
CISA Vulnrichment (SSVC)
Exploitation: active Automatable: yes Technical Impact: total
Source: vulnerability-lookup.org
Exploitation Intelligence (3 sources)
Source Exploited Ransomware Use Notes
enisa-cnw-kev Yes — Affected: Fortinet / FortiOS/FortiProxy | Description: authentication bypass using an alternate path or channel vulnerability | Exploitation type: ransomware | CWEs: CWE-288 | Origin source: cnw
cisa-kev Yes Known KEV entry: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | Affected: Fortinet / FortiOS and FortiProxy | Description: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2025-01-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55591
kevintel Yes Known KEVIntel entry: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and... | Affected: Fortinet / FortiOS, FortiProxy | CVSS: 9.6 (CRITICAL) | Used in malware: yes | Not yet in CISA KEV: False
Correlated via CISA KEV, Shadowserver & KEVIntel.com. Source: vulnerability-lookup.org
Vendor Exploitability (VEX) (1 statement)
Vendor Source Status Statement
Red Hat CSAF VEX known not affected (1) Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Source: vulnerability-lookup.org
Detection Rules (3)
sigma FortiOS jsconsole exploit with admin creation or config export - STRICT (CVE-2024-55591)
Detects CVE-2024-55591 exploitation (CVSS 9.6) combining: external access to FortiOS jsconsole/API endpoints with websocket user-agent indicators AND admin account creation or configuration export API calls. Matches documented TA post-exploitation chain (super-admin creation, firewall rule modification, config download).
sigma FortiOS management API access from external IP without prior auth - BROAD (CVE-2024-55591)
Detects HTTP requests to FortiOS/FortiProxy management API endpoints from external IP addresses without a prior successful authentication event, indicating potential CVE-2024-55591 exploitation (CVSS 9.6). Pre-auth RCE via jsconsole websocket allows super-admin takeover.
suricata ET WEB_SPECIFIC_APPS Fortinet Authentication Bypass via Node.js Websocket (CVE-2024-55591)
No description provided
Source: vulnerability-lookup.org
Exploited By Ransomware Groups (3)
Ransomware Group Vendor Product Source
DragonForce Fortinet FortiOS & FortiProxy ccb.belgium.be
qilin Fortinet FortiOS & FortiProxy checkpoint.com
thegentlemen Fortinet FortiOS Unit42
References
View on CVE.org · View on NVD