WatchGuard EPDR CVE-2024-8424

Exploitation requires an existing local user account on the Windows host - low-privileged access (standard domain or local user) is sufficient per the PR:L CVSS 4.0 metric. WatchGuard EPDR, Panda AD360, or Panda Dome must be installed and the PSANHost.exe module must be actively running as a service. No non-default product configuration is required; the privilege management flaw is present in the standard out-of-box product deployment. Exploitation is strictly local (AV:L) - remote unauthenticated attack is not possible. No user interaction is required once the attacker holds a local session. Exploitation is limited by the requirement for prior local access: this vulnerability cannot serve as an initial access vector and is only reachable after an attacker has already compromised a local account on the target endpoint.

The vendor-assigned CVSS 4.0 score of 8.5 with AV:L/AC:L/AT:N/PR:L/UI:N reflects realistic exploitation parameters: local access only, low complexity, low privileges, no user interaction required. The local attack vector (AV:L) is the primary mitigating factor limiting real-world blast radius - an attacker must already hold an authenticated session on the target Windows host. EPSS at 0.19% (9th percentile) is consistent with low observed exploitation interest and the local-only nature of the flaw. The vulnerability is absent from CISA KEV and no public POC has been identified, supporting a considered rather than emergency patching posture. The vendor-assigned VC:H (confidentiality impact) appears optimistic for a pure file-deletion primitive; confidentiality impact is plausible only if an attacker targets cached credentials, security logs, or sensitive application data for deletion to cover tracks, but direct data exfiltration is not described. The high integrity and availability impacts (VI:H/VA:H) are well-grounded: deleting DLLs, security agent binaries, or Windows system files can disable defenses or render the host unbootable. Net assessment: meaningful post-exploitation or lateral-movement escalation primitive, not a critical initial-access risk.

An attacker who has obtained a low-privileged Windows user session on a host running WatchGuard EPDR - via phishing payload, credential stuffing, or lateral movement - sends a crafted IPC request to PSANHost.exe, directing the SYSTEM-context agent to delete a target file outside the attacker's normal permission scope. The attacker could delete endpoint detection log files to blind the security stack before proceeding with additional post-exploitation activity, or delete critical DLLs to disable the security agent itself. No public proof-of-concept code exists at time of analysis.