# FortiOS auth bypass exploited in Japan

Published: 2025-05-11 · Severity: critical
Canonical: https://vorant.io/reports/d6528010-5364-55d4-87de-bb0766fd404e/fortios-auth-bypass-exploited-in-japan

> Fortinet disclosed CVE-2024-55591, an authentication bypass in FortiOS enabling unauthenticated remote attackers to gain admin access; active exploitation observed in Japan.

Japan's IPA has issued an alert for CVE-2024-55591, a critical authentication bypass vulnerability in Fortinet's FortiOS. The flaw allows unauthenticated remote attackers to obtain administrator privileges without authentication. Fortinet has confirmed active exploitation of this vulnerability in the wild.

On May 12, 2025, IPA updated the advisory to note that attacks exploiting this vulnerability have been observed within Japan, increasing the urgency for affected organizations to apply patches immediately. Fortinet has released fixed versions and published indicators of compromise (IOCs) in their advisory to assist organizations in investigating potential breaches.

Organizations running affected FortiOS versions should prioritize upgrading to patched releases. Fortinet has also provided workarounds that can mitigate the vulnerability's impact until full patching is completed. Given the confirmed in-the-wild exploitation and geographic spread to Japan, this represents an active and expanding threat to enterprise networks.

## Mentioned in this report

- Vulnerabilities: CVE-2024-55591 (KEV)

## Detection guidance (public sample)

### FortiOS Admin Access via jsconsole/Node.js WebSocket Interface

ATT&CK: T1190

Detects HTTP/websocket requests to the FortiOS jsconsole management interface, the vector used to exploit CVE-2024-55591 for unauthenticated administrative access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Admin Access via jsconsole/Node.js WebSocket Interface
id: b00ccf9b-201c-56af-ab22-f621b0319524
status: experimental
description: 'Detects HTTP or websocket requests to the FortiOS jsconsole/Node.js
  websocket management endpoint. This interface has been abused to exploit CVE-2024-55591,
  an authentication bypass allowing unauthenticated attackers to obtain super-admin
  privileges on FortiOS devices.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
  category: webserver
  product: fortios
detection:
  selection:
    cs-uri-stem|contains:
    - /jsconsole
    - /api/v2/authentication
  filter_known_admin:
    c-ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate administrative use of the jsconsole feature from trusted internal management
  subnets
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
```

### FortiOS New Local Administrator Account Created Without Prior Authentication

ATT&CK: T1078

Detects creation of a new local administrator account on FortiOS shortly after an unauthenticated management-interface request, consistent with post-exploitation of the CVE-2024-55591 auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS New Local Administrator Account Created Without Prior Authentication
id: d3109add-157d-5876-bfe0-34f01287c961
status: experimental
description: 'Detects the creation of a new local admin/super-admin account on a FortiOS
  device. Attackers exploiting CVE-2024-55591 leverage the jsconsole authentication
  bypass to create rogue administrator accounts for persistent access without ever
  supplying valid credentials.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
  category: application
  product: fortios
detection:
  selection:
    action: user_add
    admin_profile: super_admin
  filter_change_ticket:
    reason|contains: scheduled-maintenance
  condition: selection and not filter_change_ticket
falsepositives:
- Legitimate administrator onboarding performed by IT staff and documented in change
  management
level: high
tags:
- attack.t1078
- attack.persistence
- attack.privilege_escalation
author: Vorant
```

### FortiOS Administrator Login Immediately Following Unauthenticated Management Request

ATT&CK: T1078

Detects a successful administrative login event on FortiOS occurring immediately after an unauthenticated request to the management interface, indicating possible abuse of a bypassed authentication flow rather than a normal login sequence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Administrator Login Immediately Following Unauthenticated Management
  Request
id: 9a6d478c-4c6d-5864-b2fe-048038b8b202
status: experimental
description: 'Detects successful super-admin authentication events on FortiOS management
  interfaces that occur without a preceding standard login/authentication challenge
  in the logs, consistent with abuse of the CVE-2024-55591 authentication bypass to
  obtain valid administrator sessions.

  '
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
  category: authentication
  product: fortios
detection:
  selection:
    action: login
    admin_profile: super_admin
    method: jsconsole
  condition: selection
falsepositives:
- Authorized administrators using the local console/jsconsole for routine device management
level: medium
tags:
- attack.t1078
- attack.defense_evasion
- attack.initial_access
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20250115.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d6528010-5364-55d4-87de-bb0766fd404e/fortios-auth-bypass-exploited-in-japan.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup