Which versions of WatchGuard Fireware OS are affected by CVE-2025-12195?

WatchGuard Firewall devices running vulnerable Fireware OS versions face a critical remote code execution risk if privileged administrators are compromised or act maliciously.

How to fix or mitigate CVE-2025-12195?

Within 24 hours: Audit administrative access logs for suspicious IPSec configuration changes and restrict CLI access to essential personnel only. Within 7 days: Identify all affected WatchGuard devices and document their versions; contact WatchGuard for patch availability and deployment timeline. Within 30 days: Implement compensating controls including network segmentation to limit firewall administrative access, enforce multi-factor authentication for administrative accounts, and consider temporary disabling of IPSec CLI configuration until patches are available.

WatchGuard Fireware OS CVE-2025-12195

Q: What is the CVSS score of CVE-2025-12195?

CVE-2025-12195 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-201306 HIGH

Out-of-bounds Write (CWE-787)

2025-12-04 5d1c2695-1a31-4499-88ae-e847036fd7e3

Memory Corruption Buffer Overflow Watchguard RCE Fireware

8.6

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

CLI is network-accessible (AV:N), exploitation is straightforward once authenticated (AC:L), but requires a privileged admin account (PR:H); arbitrary code execution yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 16:22 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201306

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 22:15 cve.org

HIGH 8.6

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 7.2

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.This vulnerability affects Fireware OS 11.0 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

AnalysisAI

Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.

Technical ContextAI

The vulnerability resides in the Fireware OS CLI's parsing of IPSec configuration parameters, classified under CWE-787 (Out-of-bounds Write). This class of bug arises when a program writes data beyond the allocated memory buffer boundary, enabling attackers to overwrite adjacent memory - including control structures such as return addresses or function pointers - to redirect execution flow. The affected component is the WatchGuard Fireware OS (CPE: cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*), which runs on WatchGuard's Firebox network appliance family. The IPSec subsystem, used for VPN tunnel configuration, accepts structured CLI commands whose improper length or bounds validation creates the overflow condition. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) confirms the CLI is network-accessible, indicating this is likely reachable via the WatchGuard management interface or SSH CLI session rather than a locally-seated terminal only.

RemediationAI

Consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00019 for specific patched version numbers - no explicit fixed release version is present in the available intelligence data, so the advisory is the authoritative source. As an immediate compensating control, restrict CLI access (SSH and management interface) to a dedicated, tightly-controlled management VLAN or jump host, preventing general administrative users from directly accessing the IPSec CLI commands. Disable or restrict IPSec configuration capabilities for all accounts that do not require them, applying the principle of least privilege within the WatchGuard role system. Enable multi-factor authentication on all administrative accounts to reduce the value of stolen credentials. Monitor CLI audit logs for unusual IPSec configuration command sequences. These controls reduce the attacker's ability to reach the vulnerable code path, but do not eliminate the vulnerability - patching to the vendor-fixed version remains the definitive remediation.