CVE-2024-55591

CWE-288

Critical

103.7

RPS

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Source: NVD

CVSS: 9.8; Critical · v3.1
EPSS: 94.14%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Jan 2025
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-288
Published: 14 Jan 2025; Last modified 5 Aug 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2024-55591

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 8 Oct 2026, 05:16 UK time

CVE-2024-55591

Description

Signals

Get this score from the API