Which versions of Mobile VPN with SSL are affected by CVE-2024-4944?

WatchGuard Mobile VPN with SSL client for Windows contains a privilege escalation vulnerability (CVSS 8.6) that could give any local user system-level access to affected endpoints.

How to fix or mitigate CVE-2024-4944?

Within 24 hours: conduct asset discovery to identify all Windows systems running WatchGuard Mobile VPN with SSL client, prioritizing systems with elevated-privilege accounts or handling sensitive data. Within 7 days: implement file system access controls restricting modification of VPN client installation directories, deploy endpoint detection and response (EDR) tools configured to detect local privilege escalation attempts, and document the business justification for each system running the client. Within 30 days: monitor WatchGuard security advisories and vendor communications for patches; if no patch becomes available within 30 days, evaluate alternative VPN solutions or architectural changes to reduce dependency on the affected client; conduct security testing to validate compensating control effectiveness.

Mobile VPN with SSL CVE-2024-4944

Q: What is the CVSS score of CVE-2024-4944?

CVE-2024-4944 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Command Injection (CWE-77)

2024-07-09 5d1c2695-1a31-4499-88ae-e847036fd7e3

Privilege Escalation Watchguard Command Injection Microsoft Mobile Vpn With Ssl

8.6

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

8.6 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and low complexity confirmed; PR:L chosen because a local user session is required, and scope unchanged as privilege escalation stays within the same host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 16:30 vuln.today

v2 (cvss_changed)

CVSS changed

Jul 31, 2026 - 16:22 NVD

8.5 (HIGH) 8.6 (HIGH)

Analysis Updated

Jul 29, 2026 - 23:27 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 23:22 NVD

7.8 (HIGH) 8.5 (HIGH)

CVE Published

Jul 09, 2024 - 03:15 nvd

HIGH 7.8

DescriptionCVE.org

A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged.

AnalysisAI

Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows any local user to execute arbitrary commands with elevated privileges via a command injection flaw (CWE-77). The vulnerability resides in the Windows client application and requires only local system access with no special prior privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.31% (23rd percentile) indicates low current exploitation probability; no public exploit identified at time of analysis.

Technical ContextAI

CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a class of defects where user-controlled input is incorporated into a system or shell command without adequate sanitization, allowing injected metacharacters to alter command semantics. The affected component is the WatchGuard Mobile VPN with SSL client application running on Microsoft Windows (CPE: cpe:2.3:a:watchguard:mobile_vpn_with_ssl:*:*:*:*:*:*:*:*). The wildcard CPE version string indicates no specific version is scoped out, suggesting all currently distributed versions of the Windows client are potentially affected. The VPN client's privileged service or helper binary likely executes OS commands on behalf of an unprivileged local user session, and the injection point allows that unprivileged user to hijack the elevated execution context.

RemediationAI

Consult WatchGuard PSIRT advisory WGSA-2024-00010 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00010 for the authoritative patched version - no exact fix version is confirmed from the available data, so 'patch available per vendor advisory' is the current status. Until the patch is applied, consider restricting local interactive logins to the minimum required users on endpoints running the Mobile VPN with SSL client, as the vulnerability requires local system presence. Enforcing application whitelisting (e.g., Windows Defender Application Control) to prevent untrusted binaries from spawning child processes may reduce exploitability as a compensating control, though it does not eliminate the root cause. Monitor endpoint security tools for anomalous process creation chains originating from the VPN client service. Note that removing the VPN client as a workaround would impact remote access capability for affected users.