CVE-2024-6593
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.
An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user credentials.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WatchGuard | SSO Agent | 12.0 <= 12.10.2 | affected |
Weaknesses
- CWE-863: CWE-863
Workarounds
An attacker must have already established network access to exploit this vulnerability. WatchGuard recommends using Windows Firewall rules to restrict TCP port 4114 network access to the Authentication Gateway to only allow connections from the Firebox. Windows administrators can use Group Policy objects to add Windows firewall rules to their endpoints.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: total
References
- https://psirt.watchguard.com/CVE-2024-6593
- https://www.redteam-pentesting.de/advisories/rt-sa-2024-007
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00015
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.