WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
Summary
| CVE | CVE-2024-6592 |
|---|---|
| State | PUBLISHED |
| Assigner | WatchGuard |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-09-25 12:15:05 UTC |
| Updated | 2026-08-08 00:16:33 UTC |
| Description | An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from 5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-306 | CWE-863 | CWE-306 CWE-306
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 5d1c2695-1a31-4499-88ae-e847036fd7e3 | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Watchguard | Authentication Gateway | All | All | All | All |
| Application | Watchguard | Single Sign-on Client | All | All | All | All |
| Application | Watchguard | Single Sign-on Client | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WatchGuard | SSO Client | affected 12.0 12.7 semver | Windows |
| CNA | WatchGuard | SSO Client | affected 12.0 12.5.4 semver | macOS |
| CNA | WatchGuard | SSO Agent | affected 12.0 12.10.2 semver | Not specified |
| ADP | Watchguard | Authentication Gateway | affected 12.10.2 semver | Not specified |
| ADP | Watchguard | Single Sign-on Client | affected 12.7 semver | Not specified |
| ADP | Watchguard | Single Sign-on Client | affected 12.5.4 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| psirt.watchguard.com/CVE-2024-6592 | 5d1c2695-1a31-4499-88ae-e847036fd7e3 | psirt.watchguard.com | |
| www.redteam-pentesting.de/advisories/rt-sa-2024-006 | 5d1c2695-1a31-4499-88ae-e847036fd7e3 | www.redteam-pentesting.de | |
| www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014 | 5d1c2695-1a31-4499-88ae-e847036fd7e3 | www.watchguard.com | Mitigation, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Workarounds
CNA: An attacker must have already established network access to exploit this vulnerability. WatchGuard recommends using Windows Firewall rules to restrict TCP port 4116 network access to the Single Sign-On Client to only allow connections from the Authentication Gateway (SSO Agent), and restricting TCP port 4114 network access to the Authentication Gateway to only allow connections from the Firebox. Windows administrators can use Group Policy objects to add Windows firewall rules to their endpoints.
Exploits
CNA: WatchGuard is not aware of any exploitation of this vulnerability in the wild.