watchguard-sso-client

Proof of Concept for Watchguard SSO Agent Vulnerabilitites CVE-2024-6592, CVE-2024-6593, CVE-2024-6594 Details are described in our advisories available at: CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 The script requires the Python click library to run. Examples Issue Arbitrary Commands to SSO...

log4shell-iocs

Log4Shell-IOCs IOC feeds curated by WatchGuard Threat Lab that contain recent attempts to probe or exploit CVE-2021-44228 in Log4j2 Analyst Comments 2021-12-17 Threats shared in this feed should be used for THREAT HUNTING and added to a WATCHLIST. We strongly recommend NOT adding them to a...

WatchGuard Fireware AD Helper Component - Credentials Disclosure

WatchGuard Fireware Threat Detection and Response TDR service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext. id: CVE-2020-10532 info: name: WatchGuard Fireware ...

watchguard_cve-2022-26318

watchguardcve-2022-26318 Watchguard RCE POC CVE-2022-26318 !/usr/bin/python3 -- coding: utf-8 - - CVE-2022-26318 import socket import ssl import gzip Remote WatchGuard XTM or FireWare OS RHOST = "1.1.1.1" Local host with nc listener: nc -l 8.8.8.8 8888 LHOST = "8.8.8.8" def buildPayloadLHOST:...

hook

Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script...

watchTowr-vs-WatchGuard-CVE-2025-9242

watchTowr-vs-WatchGuard-CVE-2025-9242 Detection Artifact Generator for WatchGuard CVE-2025-9242 https://github.com/user-attachments/assets/097f099b-ba60-4223-adea-04279570460f See our blog post for technical details Detection in Action python watchTowr-vs-WatchGuard-CVE-2025-9242.py --rhost...

cve-2022-31749

CVE-2022-31749 by 1vere$k Simple PoC-checker for CVE-2022-31749 by 1vere$k. It exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there...

CVE-2025-1910-WatchGuard-Privilege-Escalation

WatchGuard Mobile VPN with SSL Client Privilege Escalation CVE-2025-1910 A privilege escalation vulnerability in WatchGuard's Mobile VPN with SSL MD5SUM Pack into a .wgssl file tar -czf ../clientexploit.wgssl client.ovpn MD5SUM run.bat cd .. 5. Serve the malicious client.wgssl file via flask: Sta...

CVE-2025-14733

WatchGuard IKEv2 Scanner — CVE-2025-14733 Identify WatchGuard Firebox appliances vulnerable to CVE-2025-14733, a critical pre-authentication vulnerability in the Fireware OS IKEv2 implementation. This tool performs safe version detection through standard IKEv2 negotiation. It does not attempt...

Watchguard_WebUI_Unpacker

Watchguard Fireware Web UI update unpacker unpackwatchguard is a tool that unpacks this file format sysa-dl. watchguardsysadl.ksy contains Kaitai description of Watchguard Fireware web update file format. Info This update format is used by WatchGuard Firebox firewalls. The unpacker has been teste...

Watchguard-RCE-POC-CVE-2022-26318

Watchguard-RCE-POC-CVE-2022-26318 PoC for Watchguard CVE-2022-26318 updated to work with Python3.12 as the ssl.wrapsocket is deprecated. PoC originally from https://github.com/h3llk4t3/Watchguard-RCE-POC-CVE-2022-26318/blob/main/POCwg.py...

Watchguard-RCE-POC-CVE-2022-26318

Watchguard-RCE-POC-CVE-2022-26318 Watchguard RCE POC CVE-2022-26318 The CVE for this issue is CVE-2022-26318...

CVE-2026-57907

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

CVE-2026-57907

A privilege escalation vulnerability exists in WatchGuard Endpoint Protection due to a flaw in the inter-process communication between the console and the protection service. A local, low-privileged authenticated user can exploit this by injecting code into the trusted console process and issuing...

CVE-2026-57907 WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

CVE-2026-57907 WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

EUVD-2026-121398

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

CVE-2026-57907: WatchGuard Endpoint Security: A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the…

A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process...

CVE-2026-121638

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers...

CVE-2026-121640

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services...