CVE-2024-55591

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.6EPSS 94%

Published 2025-01-14Updated 2025-04-27

Exploited in the wildMedia 186037PoC

Vulnerability details

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

CNAfortinet

EPSS score history

Sources

35 links

PoC links are not available for guest users. Login to view them.

Profile

CVSS

9.6

EPSS

94%

Published

2025-01-14

Updated

2025-04-27

CNA

fortinet

Vendors

Fortinet

2 products

CPEs

cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*

cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated