Fireware OS CVE-2025-12196

Exploitation requires an authenticated session with high (administrative/privileged) credentials on the WatchGuard Fireware OS CLI, as explicitly confirmed by the CVSS 4.0 vector (PR:H). The attack is delivered over the network (AV:N), so physical access to the appliance is not required, but valid privileged credentials must be obtained beforehand. No user interaction beyond authentication is needed (UI:N). Lower-privilege or read-only accounts cannot trigger the flaw. The CVSS AT:N metric confirms no additional technical prerequisites - no special non-default configuration, no specific protocol mode, and no secondary target interaction are required beyond the authenticated CLI session. The primary limiting factor is credential possession: without high-privilege account access, the vulnerability cannot be reached.

The CVSS 4.0 score of 8.6 reflects the full RCE impact triad (VC:H/VI:H/VA:H) moderated by the high-privilege requirement (PR:H), which is the primary constraint limiting attacker population to already-authenticated administrators. EPSS at 0.15% (35th percentile) is consistent with this barrier - low automation potential and no public exploit code suppress exploitation probability despite the high severity ceiling. No CISA KEV listing exists, confirming no known active in-the-wild exploitation at time of analysis. That said, the network attack vector (AV:N, AT:N) means a threat actor who obtains privileged credentials through phishing, credential stuffing, or lateral movement requires no physical access to exploit this vulnerability; even a mid-sized municipal IT team in rybnik managing a WatchGuard estate should treat patching as urgent given that admin credential compromise is a realistic threat model for any organization, and successful exploitation would yield full appliance-level code execution. SSVC assessment: exploitation status 'none,' not automatable due to PR:H, but technical impact is 'total' upon credential compromise. The absence of a stated additional configuration prerequisite (AT:N) means any Fireware deployment with CLI enabled is in scope if credentials are obtained.

An attacker who has obtained high-privilege WatchGuard Fireware credentials - through spear-phishing, credential reuse, or lateral movement from a compromised internal host - authenticates to the Fireware CLI over the network and submits a specially crafted command string designed to overflow a CLI parser buffer. The out-of-bounds write corrupts adjacent memory (such as a return address or function pointer), redirecting execution to attacker-controlled code and yielding arbitrary code execution with the privileges of the CLI process on the appliance. No public proof-of-concept exploit has been identified at time of analysis.