WatchGuard AuthPoint Gateway flaws allow forged logins and disrupted authentication
A company login relay device can have its login results forged!
Summary
Several flaws in WatchGuard AuthPoint Gateway let attackers forge authentication results, intercept and modify traffic to authentication providers, and disrupt authentication services without logging in. Versions from 1.0 up to but not including 7.6.0 are affected when LDAP, RADIUS or ADFS is configured.
Affected when
- LDAP provider configured
- RADIUS, LDAP or ADFS resource configured
What to do
Update AuthPoint Authentication Gateway to 7.6.0 or later. Versions below 7.6.0 are affected.
Products and platforms
CVE IDs
Sources
- Advisory: psirt.watchguard.com (opens in a new tab) · psirt.watchguard.com (opens in a new tab) · psirt.watchguard.com (opens in a new tab) · psirt.watchguard.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen