The vulnerability involves the cleartext storage of a FileVault Personal Recovery Key in a diagnostic log file created by WatchGuard Agent on macOS. An unprivileged local user can read this file, obtaining a sensitive key that can unlock the full disk encryption. This exposure constitutes a confidential data breach that could allow post‑boot access to encrypted data, and aligns with CWE‑312, CWE‑532, and CWE‑732 weaknesses.

The affected product is WatchGuard Endpoint Security’s Full Disk Encryption feature for macOS, specifically the WatchGuard Agent application. No specific version information is provided, so the issue applies to all releases of the WatchGuard Agent that write this diagnostic log.

The CVSS score of 6.9 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have local, unprivileged access to the machine to read the log file. Because the log file is readable by all local users, exploitation is straightforward and poses a risk of recovering the FileVault recovery key, potentially enabling full disk access.