WatchGuard Fireware CVE-2025-12026

Exploitation requires an authenticated, privileged user session on the WatchGuard Fireware OS CLI - the CVSS 4.0 vector explicitly specifies PR:H (high privileges), confirming that unauthenticated exploitation is not possible. The specific trigger is the certificate request CLI command, which must be accessible to the attacker's session. Network reachability (AV:N) to the management interface is required, meaning environments that expose the Fireware management CLI directly to untrusted networks face elevated risk. Exploitation is limited by the mandatory requirement for valid privileged administrator credentials; without prior credential compromise, social engineering of an admin, or insider access, the attack chain cannot be initiated. No special non-default feature enablement is required beyond standard CLI access being available.

The CVSS 4.0 score of 8.6 (High) is driven by full CIA impact (VC:H/VI:H/VA:H) on the vulnerable system, but the PR:H metric is the critical moderating factor - exploitation requires privileged, authenticated access to the Fireware CLI, substantially narrowing the attacker population. EPSS of 0.11% at the 30th percentile confirms low current exploitation interest, and the absence of a CISA KEV listing means no confirmed in-the-wild abuse has been reported. There is no known public proof-of-concept. The scope change metrics (SC:N/SI:N/SA:N) indicate exploitation is contained to the firewall appliance itself, though compromise of a firewall OS carries outsized secondary risk by potentially enabling network-level pivoting or policy manipulation. Even a mid-sized municipal IT team in sanok running WatchGuard appliances should treat this as an elevated patching priority given the sensitive role the affected product plays in network perimeter defense, despite the low EPSS - a single compromised admin credential would be sufficient to weaponize the flaw. The primary residual risk is insider threat or credential-compromise scenarios.

An attacker who has obtained or already possesses privileged WatchGuard Fireware administrator credentials connects to the appliance's management CLI over the network and issues a specially crafted certificate request command with malformed arguments designed to overflow the target buffer. The out-of-bounds write corrupts memory in the CLI process, redirecting execution flow to attacker-controlled code running within the Fireware OS environment. No public proof-of-concept has been identified, making opportunistic exploitation unlikely at this time.