CVE-2024-6592

CRITICAL

WatchGuard Authentication Gateway and Single Sign-On Client - Authentication Bypass via Protocol Communication

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-6592. PoCs published by RedTeamPentesting.

AI-analyzed exploit summary This PoC exploits multiple vulnerabilities in Watchguard SSO clients, including authentication bypass (CVE-2024-6593), arbitrary command execution (CVE-2024-6592), and log file retrieval (CVE-2024-6594). It interacts with the Telnet interface of the SSO client to perform these actions.

Description

Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.

Exploits (1)

nomisec WORKING POC 3 stars

by RedTeamPentesting · poc

https://github.com/RedTeamPentesting/watchguard-sso-client

View Code ZIP pw:eip

This PoC exploits multiple vulnerabilities in Watchguard SSO clients, including authentication bypass (CVE-2024-6593), arbitrary command execution (CVE-2024-6592), and log file retrieval (CVE-2024-6594). It interacts with the Telnet interface of the SSO client to perform these actions.

Classification

Working Poc 100%

Attack Type

Rce | Auth Bypass | Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Watchguard SSO Client

No auth needed

Prerequisites: Network access to the Watchguard SSO client's Telnet interface (port 4116 by default) · Knowledge of the target host

MITRE ATT&CK

T1059 - Command and Scripting Interpreter T1068 - Exploitation for Privilege Escalation T1040 - Network Sniffing

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Mitigation, Vendor Advisory

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014

Scores

CVSS v3 9.1

EPSS 0.0105

EPSS Percentile 59.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-306 CWE-863

Status published

Products (3)

watchguard/authentication_gateway < 12.10.2

watchguard/single_sign-on_client < 12.5.4

watchguard/single_sign-on_client < 12.7

Published Sep 25, 2024

Tracked Since Feb 18, 2026