The WatchGuard Terminal Services Agent on Windows does not properly set directory permissions if installed outside the default directory path. This misconfiguration can be exploited by an authenticated local user to escalate privileges to SYSTEM level. The vulnerability is identified as CWE-276 (Incorrect Default Permissions). It affects version 12.0 of the product. The CVSS 4.0 base score is 6.3, indicating a medium severity with local attack vector, low attack complexity, and requiring low privileges but no user interaction. No official patch or remediation guidance has been published by the vendor as of the publication date.

An authenticated local attacker on a vulnerable system can exploit this vulnerability to escalate their privileges to SYSTEM, potentially gaining full control over the affected machine. This could lead to unauthorized system modifications or access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid installing the WatchGuard SSO Terminal Services Agent in non-default directories or restrict local user access to installation directories to mitigate risk.