Fortinet Discloses Active Exploitation of Critical Zero-Day Vulnerability: CVE-2024-55591

Note: These vulnerabilities remain under active exploitation and Kroll experts are investigating. If further details are uncovered by our team, updates will be made to the Kroll Cyber Risk blog.

A critical authentication bypass vulnerability (CWE-288) affecting FortiOS and FortiProxy (FG-IR-24-535) allows remote attackers to obtain super admin privileges via Node.js WebSocket traffic.

Arctic Wolf observed a campaign dubbed “Console Chaos” that targets FortiGate devices with management interfaces exposed to the internet. Attackers authenticated via jsconsole sessions, created super admin users, adjusted SSL VPN configurations and dumped domain credentials.

Fortinet has released patches to address the issue. Use the following table to assess the course of action based on the software version of devices.

Based on reporting of the ‘Console Chaos’ campaign, the following timeline describes the activity surrounding attacks using CVE-2024-55591. Based on our internet monitoring capability, Kroll believes that the campaign has been ongoing since at least November 1, 2024. 

Kroll threat intelligence has been investigating this campaign and will update reporting with additional information in due course. Kroll has been tracking this campaign as KTAC007. Kroll assesses that the campaign is opportunistic and is not confined to any industry or geography. Due to the large attack surface with millions of FortiGate services available on the internet, attackers will likely continue to use CVE-2024-55591 to compromise as many devices as possible before a patch is applied.

Kroll has been actively hunting for this activity and is confident in its ability to detect malicious activity associated with this campaign.

Recommendations

• Update FortiOS and FortiProxy appliances according to vendor advisory.
• Restrict access to the management console from WAN. Mitigations are also available in the advisory.
• Contact Kroll if you wish to discuss devices believed to be compromised.