CVE-2024-55591

9.8CRITICAL

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12

发布于: 1/14/2025更新于: 10/24/2025
在NVD查看在MITRE查看

CISA已知被利用漏洞

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

所需操作:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

截止日期:

2025-01-21

已知勒索软件使用

描述

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

AI分析AI驱动

受影响产品

fortinetfortiproxy
fortinetfortiproxy
fortinetfortios

参考资料