WatchGuard EPDR
CVE-2024-8424
HIGH
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and PR:L match description; no scope change as impact stays within the host; C:N since only file deletion (not exfiltration) is described.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with SYSTEM permissions. This issue affects EPDR: before 8.00.23.0000; Panda AD360: before 8.00.23.0000; Panda Dome: before 22.03.00.
AnalysisAI
Arbitrary file deletion at SYSTEM privilege level is achievable on Windows endpoints running WatchGuard EPDR, Panda AD360, and Panda Dome through the PSANHost.exe module, affecting EPDR and AD360 before 8.00.23.0000 and Panda Dome before 22.03.00. A low-privileged local attacker exploits CWE-269 Improper Privilege Management in the security agent process to coerce SYSTEM-context file deletion of arbitrary targets - including security tool components, audit logs, or critical OS files. No active exploitation is confirmed and no public exploit code has been identified; EPSS sits at 0.19% (9th percentile), indicating minimal current attacker interest.
Technical ContextAI
PSANHost.exe is a core host-protection module in the WatchGuard/Panda endpoint security stack that runs with SYSTEM-level privileges as a Windows service. CWE-269 (Improper Privilege Management) indicates the module exposes a file-operation interface - likely via a named pipe, COM object, or local IPC mechanism - that fails to enforce adequate caller authorization before executing file deletion operations in the SYSTEM security context. Because the module inherits broad OS privileges by design (as a security agent), the misconfiguration allows any low-privileged local process or user to direct the agent to delete files that the calling principal would not normally be permitted to remove. All three affected product lines - WatchGuard EPDR (enterprise EDR), Panda AD360 (identity/AD-focused protection), and Panda Dome (consumer/SMB endpoint protection) - share the same vulnerable PSANHost.exe component on Windows.
Affected ProductsAI
WatchGuard EPDR versions prior to 8.00.23.0000 on Windows are affected. Panda AD360 versions prior to 8.00.23.0000 on Windows are affected. Panda Dome versions prior to 22.03.00 on Windows are affected. All three product lines share the vulnerable PSANHost.exe module. Vendor-confirmed details are available in the WatchGuard PSIRT advisory WGSA-2024-00017 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00017 and https://psirt.watchguard.com/CVE-2024-8424.
RemediationAI
Apply the vendor-released patches: upgrade WatchGuard EPDR to 8.00.23.0000 or later, Panda AD360 to 8.00.23.0000 or later, and Panda Dome to 22.03.00 or later, as documented in WatchGuard advisory WGSA-2024-00017 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00017. Where immediate patching is not feasible, restrict interactive and remote local logon rights on endpoints running these products to only trusted, operationally necessary accounts using Group Policy (User Rights Assignment), reducing the pool of principals who could reach the vulnerable IPC interface - note this does not eliminate the flaw and increases operational friction for legitimate administration. Enable Windows file integrity auditing (auditpol /set /subcategory:'File System' /success:enable /failure:enable) with specific watches on PSANHost.exe's process ID to detect anomalous file deletion activity as a detection control.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today