{"id":2225,"date":"2025-01-28T11:46:00","date_gmt":"2025-01-28T11:46:00","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/28\/fortinet-zero-day-exploit-grants-attackers-super-admin-privileges\/"},"modified":"2025-01-28T11:46:00","modified_gmt":"2025-01-28T11:46:00","slug":"fortinet-zero-day-exploit-grants-attackers-super-admin-privileges","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/fortinet-zero-day-exploit-grants-attackers-super-admin-privileges\/","title":{"rendered":"Fortinet Zero-Day Exploit Grants Attackers Super-Admin Privileges"},"content":{"rendered":"\n<\/p>\n

Fortinet Patches Critical Zero-Day Authentication Bypass Flaw<\/strong><\/p>\n

Affecting FortiOS and FortiProxy Products<\/strong><\/p>\n

Fortinet has patched an actively exploited zero-day authentication bypass flaw affecting its FortiOS and FortiProxy products, which attackers have been exploiting to gain super-administrative access to devices to conduct nefarious activities, including breaching corporate networks.<\/p>\n

Characterization of the Flaw<\/strong><\/p>\n

Fortinet characterized the flaw, rated as critical and tracked as CVE-2024-55591 (CVSS 9.6), as an "authentication bypass using an alternate authentication mechanism". This flaw allows attackers to bypass authentication mechanisms and gain super-administrative access to devices.<\/p>\n

Recommendations for Affected Organizations<\/strong><\/p>\n

Organizations using the devices affected by the flaw are advised to follow the appropriate update path or apply the workaround provided by Fortinet. It is recommended to use a non-standard and non-guessable username for admin accounts to offer some protection against the attack.<\/p>\n

Attack Vector and Mitigation<\/strong><\/p>\n

However, the company added, since the targeted WebSocket is not itself an authentication point, attackers still have the possibility of brute-forcing the username to exploit the flaw. Therefore, it is essential to implement additional security measures to prevent such attacks.<\/p>\n

Additional Information<\/strong><\/p>\n

For more information on the vulnerability and the patch, please visit the following resources:<\/p>\n