WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM
Priority LOW 38CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows (PSANHost.exe module) allows arbitrary file delete with SYSTEM permissions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed Endpoint Security (WatchGuard): 8.00.23.0000Panda Dome (WatchGuard): 22.03.00
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Endpoint Security | 8.00.00.0000 to before 8.00.23.0000 | 8.00.23.0000 | Patch available | CNA |
| WatchGuard | Panda Dome | 22.00.00 to before 22.03.00 | 22.03.00 | Patch available | CNA |
- Endpoint Security VendorWatchGuard Affected 8.00.00.0000 to before 8.00.23.0000 Fixed in 8.00.23.0000 Patch available CNA
- Panda Dome VendorWatchGuard Affected 22.00.00 to before 22.03.00 Fixed in 22.03.00 Patch available CNA
CPE names CISA-ADP · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:epdr_firmware:*:*:*:*:*:*:*:* | — | — | WatchGuard |
| cpe:2.3:o:watchguard:panda_ad360_firmware:*:*:*:*:*:*:*:* | — | — | WatchGuard |
| cpe:2.3:o:watchgua:panda_dome_firmware:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:o:watchguard:epdr_firmware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard
- cpe:2.3:o:watchguard:panda_ad360_firmware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard
- cpe:2.3:o:watchgua:panda_dome_firmware:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA Endpoint Security (WatchGuard) Fixed in 8.00.23.0000
- Fix · CNA Panda Dome (WatchGuard) Fixed in 22.03.00
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8424
- 2026-10-03 Alias added: GHSA-6jgr-2pw9-g4rc
References
More WatchGuard vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
- TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2024-8424 · CVE Program
- CVE-2024-8424 · NVD
- FIRST EPSS
- GHSA-6jgr-2pw9-g4rc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences