---
title: "FortiOS 7.0 Websocket Auth Bypass to Super-Admin"
url: https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/
description: "CVE-2024-55591 lets unauthenticated attackers become super_admin on FortiOS 7.0.0-7.0.16 and FortiProxy 7.0/7.2. Exploited since Nov 2024. Verify and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-01-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-55591", "CVE-2025-24472"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiOS 7.0 Websocket Auth Bypass to Super-Admin

**Verdict: Check exposure.** Exploited as a zero-day in late 2024 and patched in January 2025; anyone whose FortiOS 7.0 admin interface was internet-facing back then should audit admin and VPN accounts, not just the firmware version.

- **Who must act:** Owners of FortiGate on FortiOS 7.0.0-7.0.16 or FortiProxy 7.0.0-7.0.19 / 7.2.0-7.2.12 whose HTTP/HTTPS management interface was reachable from the internet.
- **Who can relax:** FortiOS 6.4, 7.2, 7.4 and 7.6 users (not affected), and 7.0 users who restricted management access to trusted networks and upgraded to 7.0.17 or later.
- **Affected:** FortiOS 7.0.0 through 7.0.16; FortiProxy 7.0.0 through 7.0.19; FortiProxy 7.2.0 through 7.2.12
- **Fixed:** FortiOS 7.0.17; FortiProxy 7.0.20; FortiProxy 7.2.13
- **CVEs:** CVE-2024-55591, CVE-2025-24472
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm firmware with get system status; upgrade FortiOS 7.0 to 7.0.17 or later (or migrate to a supported newer branch) and FortiProxy to 7.0.20 / 7.2.13 or later.
2. Disable the HTTP/HTTPS admin interface on WAN, or restrict it with local-in policies to a management address group.
3. Audit config system admin and local users for unknown super_admin accounts, unexpected SSL VPN group members and new SSL VPN portals.
4. Search logs for ui=jsconsole admin logins and system.admin additions, and the Fortinet-listed attacker IPs.
5. If compromised, treat the device as fully owned: restore a clean config, reset all admin and VPN credentials, and investigate the internal network for lateral movement such as DCSync.

### How to check if you are affected

- Event logs with logdesc="Admin login successful" and ui="jsconsole", especially with spoofed-looking IP pairs like 127.0.0.1, 1.1.1.1/2.2.2.2 or 8.8.8.8/8.8.4.4.
- Configuration logs showing an Add action on system.admin via jsconsole with a random 5-6 character username and super_admin profile.
- Admin or SSL VPN sessions from 45.55.158.47, 87.249.138.47, 155.133.4.175, 37.19.196.65, 149.22.94.37 or 158.255.215.126.
- New SSL VPN portals on odd ports (e.g. 4433, 59449, 59450) or changes to existing SSL VPN groups.

## What happened

On January 14, 2025, Fortinet published [FG-IR-24-535](https://fortiguard.fortinet.com/psirt/FG-IR-24-535) for CVE-2024-55591. The flaw is an authentication bypass in the Node.js websocket module of FortiOS and FortiProxy. A remote attacker with no credentials can send crafted requests and gain super-admin privileges. Fortinet confirmed in-the-wild exploitation when it published the advisory, and CISA added the CVE to KEV the same day. The KEV entry now flags known ransomware use. In February 2025 Fortinet added a second CVE, CVE-2025-24472, to the same advisory. The advisory's title also covers crafted Security Fabric (CSF) requests, although the page does not map each CVE to each path.

Exploitation started well before the patch. [Arctic Wolf's "Console Chaos" report](https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/) described scanning from November 16, 2024, reconnaissance, malicious SSL VPN setup in early December, and lateral movement, including a DCSync attempt, through late December. Victims were running firmware 7.0.14 to 7.0.16. [watchTowr](https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/) later reconstructed the root cause. A pre-authentication request can open a websocket to the CLI, and an unvalidated `local_access_token` parameter passes the session check. A race in the websocket-to-telnet proxy then lets the attacker supply the login context, including the `super_admin` profile, before the real one arrives.

## Who is affected

Only the 7.0 branch of FortiOS is affected: 7.0.0 through 7.0.16, fixed in 7.0.17. FortiProxy 7.0.0-7.0.19 and 7.2.0-7.2.12 are also affected, fixed in 7.0.20 and 7.2.13. FortiOS 6.4, 7.2, 7.4 and 7.6 are not affected. The attacker needs to reach the HTTP/HTTPS administrative interface. FortiGates that expose management only on internal interfaces, or restrict it with local-in policies, are not reachable from the internet.

Severity scores differ slightly between sources. The Fortinet CNA record gives CVSS 3.1 9.6, while the PSIRT page shows a 9.8 base score. Both are critical.

## Do you really need to act?

If you never ran FortiOS 7.0, no. If you did, the exposure question decides it. watchTowr cited Shadowserver counts of nearly 50,000 vulnerable instances after disclosure, which shows how many admin interfaces were left on the internet. Attackers used this flaw to create persistent super-admin and SSL VPN accounts. Those accounts survive a firmware upgrade, so upgrading alone does not evict an intruder. As of October 2026 the honest verdict is check-exposure. Patching was the January 2025 task. The remaining task is confirming nobody left accounts behind.

## What to do now

1. Run `get system status` on each device. Upgrade FortiOS 7.0 to 7.0.17 or later, and FortiProxy to 7.0.20 or 7.2.13 or later. Better still, move off the aging 7.0 branch.
2. Remove HTTP/HTTPS admin access from WAN interfaces, or add local-in policies that accept management traffic only from a trusted address group and deny all other sources. If you do not use Security Fabric, Fortinet's workaround for the CSF path is `config system csf` / `set status disable`.
3. Review `show system admin` and local users for accounts you did not create, especially random 5-6 character names with `super_admin`.
4. Check SSL VPN groups and portals for unexpected members or portals on custom ports.
5. If you find intrusion evidence, restore a known-good configuration, rotate every admin, VPN and LDAP credential the device held, and hunt internally for lateral movement.

## How to tell if you were hit

Fortinet's IOCs focus on logs. Look for admin logins with `ui="jsconsole"` and `logdesc="Admin login successful"`, and for an `Add` action on `system.admin` via `jsconsole(127.0.0.1)`. Usernames seen include Gujhmk, Ed8x4k, G0xgey, Pvnw81 and 1a2n6t. The attacker spoofed IPs in these logs, such as 127.0.0.1, 1.1.1.1/2.2.2.2 and 8.8.8.8/8.8.4.4. Fortinet says not to block on those, but they are a strong hunting signal. Real attacker IPs listed by Fortinet include 45.55.158.47, 87.249.138.47, 155.133.4.175, 37.19.196.65, 149.22.94.37 and 158.255.215.126. Arctic Wolf also saw bursts of sub-second admin sessions and loopback traffic on TCP 8023 and 9980 that matched jsconsole timestamps.

## Timeline

- Nov 16, 2024 — Arctic Wolf observes scanning against FortiGate management interfaces begin.
- Dec 4, 2024 — Attackers begin configuring SSL VPN access on victim devices.
- Jan 10, 2025 — Arctic Wolf publishes "Console Chaos."
- Jan 14, 2025 — Fortinet publishes FG-IR-24-535 with fixes. CISA adds the CVE to KEV.
- Jan 27, 2025 — watchTowr publishes its root-cause analysis and detection artifact generator.
- Feb 11, 2025 — Fortinet adds CVE-2025-24472 to the advisory.

## Sources

1. [Fortinet PSIRT — FG-IR-24-535 Authentication bypass in Node.js websocket module and CSF requests](https://fortiguard.fortinet.com/psirt/FG-IR-24-535)
2. [CVE Program — CVE-2024-55591 record (Fortinet CNA)](https://cveawg.mitre.org/api/cve/CVE-2024-55591)
3. [Arctic Wolf Labs — Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls](https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/)
4. [watchTowr Labs — Get FortiRekt, I Am The Super_Admin Now (CVE-2024-55591)](https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/)

---
Source page: https://erroneo.us/security/briefs/fortios-websocket-auth-bypass-cve-2024-55591/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt