Exploited vulnerabilitiesBriefPublic record
FortiOS / FortiProxy auth bypass (CVE-2024-55591)
Disclosed 14 Jan 2025. Node.js websocket module auth bypass to super-admin.
- Disclosed
What happened
- Affected: FortiOS 7.0.0 to 7.0.16. Fixed: 7.0.17.
- KEV: 14 Jan 2025. Exploited since Nov 2024 (Arctic Wolf).
Live scores
Live scores
CVE-2024-55591- EPSS
- 0.944
very likely to be attacked soon - VEDAS
- 0.979
strong exploit evidence - On CISA KEV
- Yes, since 2025-01-14
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.