CVE-2024-55591

CRITICAL9.8Published on January 14, 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-288

Vendorsfortinet

Affected products

Vendors	Prodotto	Versioni
fortinet	fortiproxy	< 7.0.20
fortinet	fortios	< 7.0.17

Ransomware

Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs

CISA advisory on Gunra ransomware group exploiting exposed firewalls and VPNs. Derived from Conti, it uses double extortion and targets multiple sectors.

Aug 16, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs