CVE-2024-6592

CRITICAL

WatchGuard - Auth Bypass

Title source: llm

Description

Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.

Exploits (1)

nomisec WORKING POC 3 stars

by RedTeamPentesting · poc

https://github.com/RedTeamPentesting/watchguard-sso-client

View Code ZIP pw:eip

References (1)

[Mitigation, Vendor Advisory] https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014

Scores

CVSS v3 9.1

EPSS 0.0252

EPSS Percentile 85.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-306 CWE-863

Status published

Products (3)

watchguard/authentication_gateway < 12.10.2

watchguard/single_sign-on_client < 12.5.4

watchguard/single_sign-on_client < 12.7

Published Sep 25, 2024

Tracked Since Feb 18, 2026