Mobile VPN with SSL CVE-2024-4944

Exploitation requires local access to a Windows system with WatchGuard Mobile VPN with SSL client installed and running. The attacker must be able to interact with the vulnerable input surface as a local user - the CVSS 4.0 PR:N metric indicates no special elevated privileges are required beyond local presence (e.g., a standard domain user or local non-admin account). The vulnerability is Windows-platform-specific; macOS or Linux VPN client deployments are not implicated. Exploitation is limited by the requirement for prior local access: internet-facing, unauthenticated remote exploitation is not possible given AV:L. The absence of a UI:N interaction requirement means the attacker does not need to socially engineer another local user to trigger the flaw.

The CVSS 4.0 score of 8.6 (High) reflects a local attack vector (AV:L) with low complexity, no privileges required, and no user interaction, with high confidentiality, integrity, and availability impact on the vulnerable system. However, real-world risk is meaningfully bounded by the local-only attack vector: an adversary must already have a foothold on the target Windows machine as a local user. EPSS at 0.31% (23rd percentile) reinforces that opportunistic, internet-scale exploitation is not occurring. The absence of a CISA KEV listing and no identified public POC further reduce urgency for remote or internet-exposed asset owners. That said, the threat profile is meaningful for insider-threat and post-initial-compromise scenarios: an attacker who has phished or otherwise compromised a standard domain user account on an endpoint running this VPN client could leverage CVE-2024-4944 to escalate to SYSTEM or administrator-level access. The no-user-interaction requirement means exploitation is fully automated once local access exists. CVSS 4.0 PR:N is notable - the vendor asserts no system privilege is needed beyond local presence, which may indicate the injection surface is reachable from a low-integrity process or session.

An attacker who has obtained a standard local or domain user account on a Windows workstation running WatchGuard Mobile VPN with SSL crafts input containing command injection characters targeting the vulnerable component of the VPN client. Because the client's privileged helper or service executes commands with elevated permissions without sanitizing this input, the injected command runs as SYSTEM or an elevated administrator, granting the attacker full control of the endpoint. No public exploit code has been identified at time of analysis, but the low-complexity, no-user-interaction nature of the flaw means a working exploit would be straightforward to develop from the vendor advisory.