LiveActive security incident?Get immediate response
CVE Record

CVE-2024-6594: WatchGuard Firebox Single Sign-On Client Denial-of-Service

Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands.

HighCVSS 8.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A remote attacker who can reach the WatchGuard Single Sign-On Client on Windows may repeatedly send malformed commands and crash its SSO service. This can interrupt authentication-dependent operations. The supplied evidence does not indicate data theft, data modification, or compromise of the host.

Executive priority

Treat this as a high-priority availability issue where SSO Client 12.0 supports important authentication workflows or is reachable from untrusted networks. Accelerate inventory, exposure reduction, and vendor-directed remediation. Priority may be lower for isolated systems with compensating access controls, given the absence of supplied active-exploitation evidence.

Technical view

CVE-2024-6594 is a CWE-755 exceptional-condition handling flaw in WatchGuard SSO Client 12.0. Network-delivered malformed commands can crash the client; repeated requests can sustain denial of service. CVSS 4.0 is 8.7, reflecting unauthenticated, low-complexity network access and high availability impact, without stated confidentiality or integrity impact.

Likely exposure

Exposure is limited to organizations running WatchGuard SSO Client 12.0 on Windows where an attacker can establish network access to the client. The bundle marks other versions unaffected by default but supplies no deployment-port, topology, or asset-discovery details. Internet exposure should not be assumed without environment-specific validation.

Exploitation context

The supplied record does not list this CVE in CISA KEV and provides no evidence of active exploitation. Exploitation requires network reachability but reportedly needs no privileges or user interaction. Repeated malformed commands could maintain service disruption; no broader compromise is established by the sources.

Researcher notes

The described root cause is improper exceptional-condition handling rather than memory corruption or an authentication bypass. Impact in the supplied CVSS vector is confined to vulnerable-system availability. Exact command format, listening interface, affected service behavior, fixed version, and recovery characteristics are not established in the bundle summary and should be confirmed from the cited advisories.

Mitigation direction

  • Review WatchGuard's current advisory for the supported fixed release or vendor-approved remediation.
  • Restrict network access to SSO Client systems to explicitly authorized management and authentication sources.
  • Segment SSO infrastructure from untrusted networks and unnecessary internal client segments.
  • Monitor the SSO service for repeated crashes and restore service using established recovery procedures.

Validation and detection

  • Inventory Windows systems running WatchGuard SSO Client and record their exact versions.
  • Identify any SSO Client 12.0 installations and prioritize reachable or authentication-critical systems.
  • Verify network controls permit access only from required, trusted sources.
  • Review service and endpoint logs for unexplained SSO crashes or repeated abnormal connections.
  • Confirm remediation against WatchGuard's advisory and retest service stability without sending malformed traffic.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-755: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-6594 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.7 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——WatchGuard

Vulnerability scoring details

Base CVSS 4.0 score

8.7High
CVSS 4.0 vector shape for CVE-2024-6594Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
WatchGuardSSO Client12.0unaffected
Weakness

CWE details

CWE-755

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-755 · source CWE mapping

Improper Handling of Exceptional Conditions

Improper Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs