CVE-2024-6593#

WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass

Critical 9.3 CVSS v4.0 › Published 2024-09-25Updated 2026-08-07

Summary #

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.

An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user credentials.

Product status #

Product	Affected	Not affected
SSO Agent	>= 12.0, <= 12.10.2	> 12.10.2

Weakness Type and Impact #

CWECWE-863Incorrect Authorization
CAPECCAPEC-115Authentication Bypass

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Update to a fixed release per the affected-version ranges above.

Workaround #

An attacker must have already established network access to exploit this vulnerability. WatchGuard recommends using Windows Firewall rules to restrict TCP port 4114 network access to the Authentication Gateway to only allow connections from the Firebox. Windows administrators can use Group Policy objects to add Windows firewall rules to their endpoints.

References #

Credits #

Found by RedTeam Pentesting GmbH finder