In November 2024, threat actors began logging into FortiGate firewalls as super_admin. No credentials. No brute force. A WebSocket request with a modified parameter was enough to take control of the device. The firewalls kept running. Only their loyalty changed.
CVE-2024-55591 scored CVSS 9.6. The FortiOS management HTTPS interface exposed a Node.js WebSocket module. That module accepted any value in the local_access_token parameter without cryptographic validation. One request with that parameter populated produced a super_admin session in the jsconsole. No credentials required. No prior session required. One HTTP request.
The vulnerability: crafted WebSocket path bypasses authentication on the management API
The /ws/cli/ endpoint serves the FortiOS jsconsole, normally accessible only to authenticated administrators. Internally, it establishes a Telnet bridge to localhost:8023, the jsconsole daemon.
The _getAdminSession() function contained a conditional branch for the localToken parameter. When a non-null local_access_token was provided in the request, the code added it to the authentication parameters and set authParamsFound=true. No cryptographic validation occurred. Any arbitrary string worked as a valid credential.
A race condition during server initialization allowed completing the WebSocket handshake before the server enforced the connection trust boundary. From first contact to super_admin shell: seconds. The classification is CWE-288: authentication bypass using alternate path or channel. The attack did not break the primary authentication flow. It used a secondary path with no equivalent controls.
Affected versions: FortiOS 7.0.0 through 7.0.16; FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. FortiOS 7.2, 7.4, and 7.6, and FortiProxy 7.4, 7.6, and 2.0 were not affected. The only reliable IOC without endpoint telemetry is in the FortiOS logs. The signature: type=event subtype=system action=login ui=jsconsole, with no preceding HTTPS session from the same source IP. That pattern has no legitimate analog in normal operations.
Exploitation timeline: zero-day in November, public disclosure in January
Early November 2024: Arctic Wolf began tracking the campaign. Unexpected super_admin logins via jsconsole appeared across multiple customer environments. No CVE had been assigned, no patch existed, and no public advisory had been issued.
Exploitation continued for 6 weeks without defenders knowing about the problem. On January 14, 2025, Fortinet published advisory FG-IR-24-535. On the same day, CISA added CVE-2024-55591 to the Known Exploited Vulnerabilities catalog. US federal agencies received a mandate to remediate by January 21, 2025, a 7-day window.
On January 15, 2025, Belsen Group published configuration data from approximately 15,000 FortiGate devices on a hacking forum. The data included plaintext VPN credentials and firewall rules. It was collected during the November 2024 zero-day window, before any patch existed and before any organization knew it was compromised.
On January 16, 2025, Fortinet released the patches: FortiOS 7.0.17, FortiProxy 7.0.20, and FortiProxy 7.2.13. On January 30, 2025, WatchTowr published a working PoC on GitHub. A mass opportunistic exploitation wave followed immediately. By mid-2025, the Gunra ransomware group was confirmed to use CVE-2024-55591 for initial access on unpatched devices, including data exfiltration and ransomware deployment.
For organizations that responded on disclosure day, patching was already incident response, not prevention.
Attack chain: bypass, super admin, rogue account, VPN pivot, lateral movement
Censys identified over 48,000 vulnerable FortiOS instances exposed to the internet at the time of disclosure. The attack followed a straight 6-step sequence.
Step 1: the attacker identified the public management HTTPS interface via Censys, Shodan, or FOFA. Step 2: a WebSocket request to /ws/cli/ with any value in local_access_token produced a super_admin session via Telnet bridge to localhost:8023. From first contact to shell: seconds.
Step 3: the attacker created a rogue administrator account with super_admin or prof_admin profile. Names ranged from randomly generated to impersonation patterns like "FortiSupport." These accounts carry a post-November 2024 timestamp in the logs and are detectable in a post-incident audit.
Step 4: the attacker modified the SSL-VPN user group to add controlled credentials. Step 5: the attacker connected via SSL-VPN and entered the network segment the firewall was supposed to protect. Step 6: lateral movement to internal targets. Arctic Wolf observed DCSync attacks against Active Directory domain controllers during post-exploitation.
The rogue admin account survived a firewall reboot. Organizations that patched without auditing admin accounts remained compromised after the fix. Two actions were required: patch and account audit. Many organizations only did one.
Belsen Group's January 15 leak: data from the zero-day window
The day after Fortinet's public disclosure, Belsen Group published an archive of approximately 750 MB on a hacking forum. The archive contained configuration files from around 15,000 FortiGate devices, including plaintext VPN credentials and firewall rules.
The data was collected during the November 2024 zero-day window. None of the affected organizations knew they were compromised when the data was exfiltrated. Rapid7 analyzed the leak and concluded the source was likely a separate prior incident, not CVE-2024-55591 directly. That did not reduce the risk for organizations in the dataset.
Organizations in that dataset faced a second exposure wave. Credential rotation was required even for devices not directly compromised by the super_admin chain. The dataset covered organizations across multiple sectors in dozens of countries.
The architectural lesson: management WebSocket on a public listener amplifies any auth bypass
FortiOS exposes its management interface on the same HTTPS listener as user-facing interfaces. There is no separate port, no separate interface, and no additional routing needed when the management endpoint is exposed to the public internet. Any authentication bypass on that path becomes immediate exploitation by any attacker with internet access.
CVE-2025-24472 (FortiOS, February 2025, CVSS 8.1) was a second authentication bypass in the management plane, this time via crafted CSF proxy requests targeting the Security Fabric channel. Two management plane bypasses in 3 months from the same product, through the same access vector. The patch for CVE-2024-55591 fixed the WebSocket path authentication. It did not change the architectural decision that made the management API reachable from the internet.
An organization using out-of-band management, on a dedicated interface, would have made the vulnerable endpoint unreachable by external attackers. The same logic flaw would exist in the code, but it would be unexploitable from outside. The 48,000+ exposed instances represent organizations that bet no authentication bypass would be found in that path. CVE-2025-24472 proved that bet wrong more than once.
The long-term fix is interface segregation: management traffic on a dedicated OOB interface, not on the same HTTPS listener as user traffic. NSA and CISA network infrastructure security guidance recommends separating management and production traffic onto distinct network segments. Fortinet's own hardening guide recommends restricting management interface access via local-in IP policies.
Detection, remediation, and what to audit after patching
Detection: search FortiOS logs for login events with ui=jsconsole without a prior HTTPS session from the same source IP. Search for admin account creation events timestamped between November 2024 and January 2025. Neither pattern has a legitimate equivalent in normal operations.
Remediation sequence:
- Patch to FortiOS 7.0.17, FortiProxy 7.0.20, or FortiProxy 7.2.13
- Audit all admin accounts. Delete any unrecognized accounts, especially prof_admin or super_admin profiles created after November 2024
- Rotate all SSL-VPN credentials
- Restrict the management interface to trusted IPs or a dedicated OOB network
- Check the Belsen Group dataset for your device's public IP
The MAGO Intel tool (intel.mago.team) tests whether management API endpoints are reachable from external networks. It flags authentication paths that lack session binding during API security assessments.
CVE-2025-24472 arrived 3 months after CVE-2024-55591. Both bypassed FortiOS management plane authentication. Both required the management interface to be internet-reachable. The patch for the first CVE did not prevent the second. Management plane isolation would have.
Top comments (0)