FG-IR-24-535: Authentication bypass in Node.js websocket module and CSF requests
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module or via crafted CSF proxy requests. Please note that reports show this is being exploited in the wild.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-535?
The severity of FG-IR-24-535 is considered high due to the potential for remote attackers to gain super-admin privileges.
How do I fix FG-IR-24-535?
To fix FG-IR-24-535, upgrade FortiOS to version 7.0.17 or later, or FortiProxy to versions 7.2.13 or 7.0.20 and later.
Which versions are affected by FG-IR-24-535?
FG-IR-24-535 affects FortiOS versions from 7.0.0 to 7.0.16 and FortiProxy versions from 7.2.0 to 7.2.12 and 7.0.0 to 7.0.19.
What types of software are affected by FG-IR-24-535?
The vulnerability FG-IR-24-535 affects Fortinet's FortiOS and FortiProxy software products.
Can FG-IR-24-535 be exploited remotely?
Yes, FG-IR-24-535 can be exploited remotely via crafted requests to the Node.js websocket module.