WatchGuard SSO Client
CVE-2024-6594
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attacker sends malformed commands with no interaction needed; pure availability crash with no C/I impact and unchanged scope.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
4DescriptionCVE.org
Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands.
This issue affects Single Sign-On Client: through 12.7.
AnalysisAI
WatchGuard Single Sign-On Client on Windows crashes when processing malformed commands, allowing unauthenticated network-adjacent attackers to repeatedly trigger service crashes and maintain a sustained denial of service against the SSO authentication service. All versions through 12.7 are affected per vendor-confirmed CPE data. No public exploit identified at time of analysis, and an EPSS of 0.50% (39th percentile) indicates low observed exploitation probability despite the high CVSS 4.0 score of 8.7 driven by its unauthenticated network vector.
Technical ContextAI
The WatchGuard Single Sign-On Client is a Windows-based agent that integrates host authentication events with WatchGuard Firebox network security appliances, enabling identity-aware policy enforcement. The root cause is CWE-755 (Improper Handling of Exceptional Conditions): the client's command-parsing logic fails to gracefully handle malformed or unexpected input, triggering an unhandled exception that crashes the process rather than rejecting the input safely. The affected software is identified by CPE cpe:2.3:a:watchguard:single_sign-on_client:*:*:*:*:*:windows:*:*, scoped exclusively to Windows platforms through version 12.7. The vulnerability was independently discovered and reported by RedTeam Pentesting (advisory rt-sa-2024-008), corroborating the WatchGuard PSIRT disclosure WGSA-2024-00016.
RemediationAI
The primary remediation is to upgrade the WatchGuard Single Sign-On Client beyond version 12.7 per the vendor advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00016; the exact patched version should be confirmed directly with WatchGuard PSIRT, as a specific fixed release number is not independently confirmed from available data. As a compensating control prior to patching, restrict network-level access to the SSO client's listening port using host-based firewall rules or perimeter controls so that only trusted WatchGuard Firebox appliances and authorized authentication servers can communicate with the client - this directly limits the attacker's ability to send malformed commands. Note that broad port-blocking may interrupt legitimate SSO authentication flows and should be implemented with application-owner coordination. Disabling the SSO Client service entirely is a high-impact workaround that eliminates the attack surface but will break identity-aware policy enforcement on the WatchGuard appliance.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today