FortiOS / FortiProxy CVE-2024-55591 (authentication bypass via the Node.js websocket module gives super-admin, exploited, CISA KEV, FG-IR-24-535): which versions are fixed and what should I look for in the logs?

What it is: CVE-2024-55591 is an authentication bypass in FortiOS and FortiProxy. Crafted requests to the Node.js websocket module behind the web management interface let a remote attacker get super-admin rights on the firewall without credentials. Fortinet published it in January 2025 (advisory FG-IR-24-535, later also covering CVE-2025-24472 in Security Fabric requests), said it was being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-01-14. Attackers used it to create admin and local accounts, change firewall policies and set up SSL-VPN access. Am I affected: - FortiOS 7.0.0 through 7.0.16; FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. - Fortinet lists FortiOS 6.4, 7.2, 7.4 and 7.6 and FortiProxy 2.0, 7.4 and 7.6 as not affected. - Highest risk: the HTTP/HTTPS admin interface reachable from the internet. Check the version with get system status or on the dashboard. Fix: 1. Upgrade: FortiOS 7.0.17 or later; FortiProxy 7.0.20 or later, or 7.2.13 or later. Use Fortinet's upgrade path tool to plan the steps. 2. Until then, turn off HTTP/HTTPS admin access on internet-facing interfaces, or restrict it to trusted management networks with local-in policies (Fortinet notes trusted-host settings only help if every admin has them). Disabling the Security Fabric feature covers the related CSF request issue. 3. Hunt for compromise using the advisory's indicators: unrecognized successful admin logins via the jsconsole interface, new admin accounts or local users with random-looking names, changes to user groups (including SSL-VPN groups), firewall policies or address objects you didn't make, and SSL-VPN logins from unfamiliar local users. Fortinet notes the IP addresses written into those log lines are attacker-chosen, so don't rely on them for blocking. 4. If you find signs of compromise: remove rogue accounts, review and restore the configuration from a known-good backup, reset all admin and local user passwords, rotate VPN credentials and any secrets stored on the device, and investigate the network behind it. Verify: the device runs a fixed release, the admin interface isn't open to the internet, and no unknown accounts or policy changes remain. Sources: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 https://nvd.nist.gov/vuln/detail/CVE-2024-55591 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591