Kernel Memory Disclosure in WatchGuard Endpoint Security

Executive Summary

This is a missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, leading to disclosure of kernel and process memory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires local, authenticated access to exploit. Detection should focus on verifying the installed version of WatchGuard Endpoint Security for Windows. Check the version against the affected range (>=0 but <8.00.26.0012). Use the Windows Control Panel or run 'wmic product get name,version' in Command Prompt to check the installed version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive kernel and process memory, potentially gaining access to confidential data or escalating privileges on the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive kernel and process memory, potentially exposing personal or confidential data. This may violate data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information), depending on the data involved.

Useful 0 Not Useful 0

Mitigation Strategies

Update WatchGuard Endpoint Security for Windows to version 8.00.26.0012 or later to address the missing authentication vulnerability in PSKMAD.

Useful 0 Not Useful 0