WatchGuard Authentication Gateway
CVE-2024-6592
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity, unauthenticated authorization bypass (AV:N/AC:L/PR:N/UI:N) yielding identity impersonation with high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.
AnalysisAI
Authentication bypass in WatchGuard's Single Sign-On stack lets remote unauthenticated attackers subvert the protocol communication between the Authentication Gateway (SSO Agent) on Windows and the SSO Clients on Windows/macOS, allowing an attacker to be authenticated as another user. The flaw stems from an incorrect authorization check (CWE-306) in the agent-to-client protocol and carries a CVSS 4.0 base score of 9.3. No CISA KEV listing indicates active exploitation, but independent technical exploitation details are publicly documented in the RedTeam Pentesting advisory rt-sa-2024-006, while the EPSS probability remains modest at 1.03% (60th percentile).
Technical ContextAI
The affected technology is WatchGuard's Single Sign-On (SSO) infrastructure, used to transparently map network activity to Active Directory user identities for firewall policy enforcement. The Authentication Gateway (formerly Single Sign-On Agent) runs on a Windows server and communicates over a network protocol with lightweight SSO Client software deployed on end-user Windows and macOS machines; the client reports the logged-in user to the gateway, which the firewall then trusts for identity-based access control. The root cause is CWE-306-class behavior (Missing/Incorrect Authorization for a critical function): the protocol between gateway and client fails to properly verify the authenticity or authorization of the party asserting an identity, so an attacker who can speak the protocol can impersonate or assert an arbitrary user identity. Per the CPE data the vulnerable components are cpe:2.3:a:watchguard:authentication_gateway, cpe:2.3:a:watchguard:single_sign-on_client (windows), and cpe:2.3:a:watchguard:single_sign-on_client (macos).
RemediationAI
Apply the fixed releases published by WatchGuard: upgrade the Authentication Gateway / SSO Agent beyond 12.10.2 and the SSO Clients beyond 12.7 (Windows) and 12.5.4 (macOS) to the patched versions referenced in WatchGuard advisory WGSA-2024-00014 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014). Patch available per vendor advisory; consult the advisory for the exact fixed build numbers, as no exact fix version is present in the source data and version numbers should not be invented. Where immediate patching is not possible, restrict network reachability of the SSO Agent's listening port so that only trusted management/client subnets can initiate the SSO protocol (trade-off: legitimate SSO clients outside those subnets lose transparent authentication and may require manual/fallback authentication), and consider temporarily disabling transparent SSO in favor of explicit firewall authentication until clients and the gateway are updated (trade-off: increased user friction and loss of identity-based policy transparency).
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today