Vulnerability · Published Sep 25, 2024 · Assigned by WatchGuard

CVE-2024-6593WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass

Critical 9.3

In plain English

A critical-severity incorrect authorization in SSO Agent from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user credentials.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	SSO Agent	12.0 – through 12.10.2

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://psirt.watchguard.com/CVE-2024-6593 vendor-advisory
https://www.redteam-pentesting.de/advisories/rt-sa-2024-007 technical-description
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00015 vendor-advisory