CVE-2024-6592

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://psirt.watchguard.com/CVE-2024-6592
https://www.redteam-pentesting.de/advisories/rt-sa-2024-006
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:watchguard:authentication_gateway::::::::
	cpe:2.3:a:watchguard:single_sign-on_client::::::macos::*
	cpe:2.3:a:watchguard:single_sign-on_client::::::windows::*

History

No history.

Information

Published : 2024-09-25 12:15

Updated : 2026-08-08 00:16

NVD link : CVE-2024-6592

Mitre link : CVE-2024-6592

CVE.ORG link : CVE-2024-6592

JSON object : View

Products Affected

watchguard

single_sign-on_client
authentication_gateway

CWE

CWE-306

Missing Authentication for Critical Function

CWE-863

Incorrect Authorization

{"id": "CVE-2024-6592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6592", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-09-25T13:54:19.684697Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "affectedData": [{"vendor": "WatchGuard", "product": "SSO Client", "versions": [{"status": "affected", "version": "12.0", "versionType": "semver", "lessThanOrEqual": "12.7"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "WatchGuard", "product": "SSO Client", "versions": [{"status": "affected", "version": "12.0", "versionType": "semver", "lessThanOrEqual": "12.5.4"}], "platforms": ["macOS"], "defaultStatus": "unaffected"}, {"vendor": "WatchGuard", "product": "SSO Agent", "versions": [{"status": "affected", "version": "12.0", "versionType": "semver", "lessThanOrEqual": "12.10.2"}], "defaultStatus": "unaffected"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:watchguard:authentication_gateway:*:*:*:*:*:*:*:*"], "vendor": "watchguard", "product": "authentication_gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "12.10.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:watchguard:single_sign-on_client:*:*:*:*:*:windows:*:*"], "vendor": "watchguard", "product": "single_sign-on_client", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.7"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:watchguard:single_sign-on_client:*:*:*:*:*:macos:*:*"], "vendor": "watchguard", "product": "single_sign-on_client", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.5.4"}], "defaultStatus": "unaffected"}]}], "published": "2024-09-25T12:15:05.027", "references": [{"url": "https://psirt.watchguard.com/CVE-2024-6592", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}, {"url": "https://www.redteam-pentesting.de/advisories/rt-sa-2024-006", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}, {"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014", "tags": ["Mitigation", "Vendor Advisory"], "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components.\n\nIn the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials."}, {"lang": "es", "value": "La vulnerabilidad de autorizaci\u00f3n incorrecta en la comunicaci\u00f3n de protocolo entre WatchGuard Authentication Gateway (tambi\u00e9n conocido como Single Sign-On Agent) en Windows y WatchGuard Single Sign-On Client en Windows y MacOS permite la omisi\u00f3n de la autenticaci\u00f3n. Este problema afecta a Authentication Gateway: hasta la versi\u00f3n 12.10.2; Windows Single Sign-On Client: hasta la versi\u00f3n 12.7; MacOS Single Sign-On Client: hasta la versi\u00f3n 12.5.4."}], "lastModified": "2026-08-08T00:16:33.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:watchguard:authentication_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7CF4A96-DAAE-4DBE-A2CF-EED3B73D7CF9", "versionEndIncluding": "12.10.2"}, {"criteria": "cpe:2.3:a:watchguard:single_sign-on_client:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "44B3732D-253E-46C6-98F7-661AB40126BB", "versionEndIncluding": "12.5.4"}, {"criteria": "cpe:2.3:a:watchguard:single_sign-on_client:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "17A19E9E-0672-4673-BD4F-681E4C994EE7", "versionEndIncluding": "12.7"}], "operator": "OR"}]}], "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}