CVE-2024-6593 WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass
An attacker with network access can bypass authentication to retrieve user data or modify configuration in the WatchGuard SSO Agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6593?
CVE-2024-6593 is a critical missing authorization vulnerability in WatchGuard SSO Agent, published on 25 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.
An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user credentials.
Weakness: CWE-863
Which versions are affected by CVE-2024-6593?
It affects 1 product.
Products include Watchguard Authentication Gateway.
How do I fix CVE-2024-6593?
No fix has been published for CVE-2024-6593 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6593 being exploited?
There is no known exploitation of CVE-2024-6593 in the wild and no public exploit code.
Other vulnerabilities in WatchGuard SSO Agent
Sources
Also known as GHSA-r59w-m542-r252.