CVE-2024-55599 in FortiOS
Summary
by MITRE • 07/08/2025
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2025
The vulnerability identified as CVE-2024-55599 represents a critical security flaw in Fortinet's FortiOS and FortiProxy products that directly impacts the implementation of DNS filtering controls. This issue falls under CWE-358, which specifically addresses improperly implemented security checks for standards, indicating a fundamental weakness in how the system validates and enforces security policies. The vulnerability affects multiple versions of FortiOS including 7.6.0, 7.4.7 and below, 7.0 all versions, and 6.4 all versions, alongside various FortiProxy versions up to 7.6.1, 7.4.8 and below, 7.2 all versions, and 7.0 all versions, creating an extensive attack surface across Fortinet's product ecosystem. The flaw manifests when Apple devices attempt to bypass DNS filtering mechanisms, potentially allowing unauthorized access to restricted content or malicious domains.
The technical implementation of this vulnerability stems from insufficient validation of DNS requests originating from Apple devices within the Fortinet security infrastructure. When Apple devices connect to networks protected by affected FortiOS or FortiProxy appliances, the system fails to properly enforce DNS filtering policies that should normally prevent access to specified domains. This weakness allows remote unauthenticated attackers to circumvent content filtering controls without requiring any credentials or privileged access. The bypass occurs specifically within the DNS filtering module where the system does not adequately verify the legitimacy of DNS queries from Apple devices, creating a pathway for malicious traffic to bypass security controls that should otherwise be enforced. The flaw essentially allows attackers to exploit a gap in the security validation process that should ensure all DNS requests are properly filtered according to organizational policies.
The operational impact of this vulnerability extends beyond simple content filtering bypass, as it represents a significant compromise in network security posture for organizations relying on Fortinet appliances for DNS protection. Remote unauthenticated attackers can exploit this vulnerability to access restricted websites, bypass corporate security policies, and potentially gain access to malicious domains that would normally be blocked. The implications are particularly concerning for organizations with strict content filtering requirements, as this vulnerability undermines the fundamental security controls designed to protect against unauthorized network access. The attack vector requires no authentication, making it particularly dangerous as it can be exploited by anyone with network access, potentially leading to data exfiltration, malware delivery, or other malicious activities that bypass standard security controls. Organizations may experience unauthorized access to sensitive resources and a complete breakdown of their DNS filtering security measures.
Mitigation strategies for this vulnerability should prioritize immediate patching of affected Fortinet appliances to the latest available versions that contain the necessary security fixes. Organizations should implement network segmentation to limit the impact of potential exploitation and consider deploying additional monitoring controls to detect anomalous DNS traffic patterns that may indicate exploitation attempts. Network administrators should also review and validate existing DNS filtering policies to ensure they are properly configured and functioning as intended. The implementation of additional security controls such as DNS sinkholing, network traffic analysis, and continuous monitoring of DNS queries can help detect and prevent exploitation attempts. Organizations should also consider implementing temporary workarounds such as disabling Apple device access to the affected DNS filtering controls until proper patches are deployed, aligning with the principle of least privilege and minimizing the attack surface. This vulnerability highlights the importance of maintaining up-to-date security controls and proper validation of security checks as outlined in the ATT&CK framework's defensive measures against evasion techniques.