CVE-2024-8424
CVE-2024-8424 is an Improper Privilege Management vulnerability affecting WatchGuard EPDR, Panda AD360, and Panda Dome on Windows. It allows arbitrary file deletion with SYSTEM permissions due to a flaw in the PSANHost.exe module. This vulnerability impacts EPDR versions prior to 8.00.23.0000, Panda AD360 versions prior to 8.00.23.0000, and Panda Dome versions prior to 22.03.00. Despite a CVSS score of 0, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate risk level, and showing that the exploit is "In The Wild." While not immediately critical based on SVRS, the ability to delete arbitrary files with SYSTEM permissions could lead to significant system instability and potential data loss if exploited by a threat actor. Immediate patching is highly recommended to prevent potential abuse.
Description
CVE-2024-8424 is a critical Improper Privilege Management vulnerability in WatchGuard EPDR, Panda AD360 and Panda Dome on Windows. The flaw resides in the PSANHost.exe module and allows an attacker with local user privileges to delete arbitrary files with SYSTEM permissions. This vulnerability impacts versions of EPDR prior to 8.00.23.0000, Panda AD360 prior to 8.00.23.0000, and Panda Dome prior to 22.03.00.
While the CVSS score is 7.8, the SVRS is 46, which indicates the vulnerability is actively exploited "In The Wild" and requires immediate attention.
Key Insights
- Serious Impact: The vulnerability allows an attacker with local user privileges to elevate their access to SYSTEM privileges. This control could be used for data theft, system takeover, or malicious activities with the highest level of system permissions.
- Exploitation Potential: This vulnerability is actively exploited "In The Wild," meaning hackers are actively using it to gain unauthorized access and compromise systems.
- Wide Impact: The vulnerability affects multiple popular security products, including WatchGuard EPDR, Panda AD360, and Panda Dome, making it a significant concern for organizations using these solutions.
- CWE-269: The CWE-269 (Improper Privilege Management) classification highlights the fundamental nature of the vulnerability, where the software fails to properly enforce access controls and grants excessive privileges to unauthorized entities.
Mitigation Strategies
- Patching: Immediately update WatchGuard EPDR to version 8.00.23.0000 or later, Panda AD360 to version 8.00.23.0000 or later, and Panda Dome to version 22.03.00 or later. Patching is the most effective way to eliminate the vulnerability.
- Principle of Least Privilege: Implement the Principle of Least Privilege to limit user permissions. This helps minimize the potential impact of the vulnerability if exploitation occurs.
- Network Segmentation: Segment the network to restrict access to sensitive resources and isolate systems vulnerable to this exploit.
- Monitoring: Implement robust security monitoring, including logs and intrusion detection systems, to detect any malicious activity or suspicious behavior related to this vulnerability.
Additional Information:
If you have additional queries regarding this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.