WatchGuard Fireware OS CVE-2025-12195

Exploitation requires an authenticated session as a privileged user on the WatchGuard Fireware OS CLI - unauthenticated exploitation is not possible per the PR:H CVSS metric. The attacker must specifically issue IPSec configuration CLI commands, meaning they need sufficient role permissions to interact with the IPSec subsystem. Network-based access is confirmed (AV:N), so SSH or management-plane access to the appliance is sufficient; physical console access is not required. The vulnerability is limited to Fireware OS versions within the four affected branches (11.0-11.12.4+541730, 12.0-12.11.4, 12.5-12.5.13, 2025.1-2025.1.2). Deployments where CLI access is restricted to a management network or jump host have a significantly reduced attack surface, as the attacker must first obtain both valid admin credentials and network-level reachability to the management interface.

The CVSS 4.0 score of 8.6 reflects the full confidentiality, integrity, and availability impact of arbitrary code execution on the firewall OS, but must be contextualized by the PR:H requirement. Only authenticated privileged users - those with administrative credentials - can trigger this vulnerability, meaning the realistic attacker is a malicious insider, a compromised admin account, or an attacker who has already achieved administrative access through a separate vector. EPSS at 0.15% (35th percentile) is consistent with a vulnerability that requires elevated privilege and lacks a public proof-of-concept, and no CISA KEV listing is present. This is not a zero-click, internet-facing exploit: it requires privileged CLI access. However, if admin credentials are phished or reused, or if another vulnerability enables privilege escalation first, this becomes a critical escalation path - executing arbitrary code on the firewall OS is a full network security compromise. The AV:N metric is notable: it means the CLI is reachable over the network, so physical proximity is not required once credentials are obtained.

An attacker who has obtained administrative credentials for a WatchGuard Firebox appliance - through phishing, credential stuffing, or a prior compromise - authenticates to the Fireware OS CLI via SSH or the management interface. The attacker issues specially crafted IPSec configuration commands containing malformed parameters that overflow a stack or heap buffer in the CLI parser, overwriting a control structure. This triggers arbitrary code execution with the privilege level of the CLI process on the Fireware OS, potentially granting full control of the network security appliance and enabling traffic interception, policy modification, or lateral movement into the protected network.