Which versions of Fireware OS are affected by CVE-2025-12196?

WatchGuard Firewall devices running affected Fireware OS versions contain a critical vulnerability allowing authenticated administrative users to execute arbitrary code through malicious CLI…

How to fix or mitigate CVE-2025-12196?

Within 24 hours: Inventory all WatchGuard Firewall devices and identify those running Fireware OS versions 12.0-12.11.4, 12.5-12.5.13, or 2025.1-2025.1.2. Within 7 days: Implement strict CLI access controls by limiting administrative CLI access to trusted personnel only, enforce multi-factor authentication for all privileged accounts, and enable comprehensive CLI command logging and monitoring. Within 30 days: Contact WatchGuard for patch availability and upgrade timelines; if patches are released, plan and execute updates across all affected devices during approved maintenance windows.

Fireware OS CVE-2025-12196

Q: What is the CVSS score of CVE-2025-12196?

CVE-2025-12196 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-201304 HIGH

Out-of-bounds Write (CWE-787)

2025-12-04 5d1c2695-1a31-4499-88ae-e847036fd7e3

Memory Corruption Buffer Overflow Watchguard RCE Fireware

8.6

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

CLI is network-accessible (AV:N, AC:L), exploitation requires high privilege (PR:H), out-of-bounds write enables full RCE with high C/I/A; scope unchanged consistent with CVSS 4.0 SC:N/SI:N/SA:N.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 16:22 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201304

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 22:15 cve.org

HIGH 8.6

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 7.2

DescriptionCVE.org

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

AnalysisAI

Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.

Technical ContextAI

WatchGuard Fireware OS (CPE: cpe:2.3:o:watchguard:fireware) is the proprietary operating system powering WatchGuard's UTM and NGFW appliance portfolio. The CLI is the primary administrative interface for device configuration and management, typically accessible over the network via SSH or a management plane. CWE-787 (Out-of-bounds Write) identifies the root cause: CLI command parsing logic fails to properly enforce buffer boundary checks, allowing a crafted input to write beyond the end of an allocated buffer. In C/C++ systems code of this type, such writes can overwrite adjacent memory such as return addresses, function pointers, or heap metadata, enabling control-flow hijacking and arbitrary code execution. The CPE data confirms the vulnerability exists across three divergent release branches (12.0.x, 12.5.x, and 2025.1.x), indicating the vulnerable code path is shared across a wide swath of the Fireware codebase rather than being isolated to a single recent change.

RemediationAI

Apply the vendor-supplied patch per WatchGuard PSIRT advisory WGSA-2025-00020 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00020); exact fixed version numbers are not stated in the available intelligence and must be confirmed directly from the advisory before patching. As an interim compensating control, restrict CLI access to a minimum set of vetted administrator accounts and enforce multi-factor authentication on all privileged accounts - this directly addresses the PR:H prerequisite by hardening the credential layer an attacker must breach. Additionally, enforce network-level access controls (firewall ACLs, dedicated management VLANs) so that the appliance CLI and management plane are reachable only from designated jump hosts or management subnets, reducing the network attack surface despite the AV:N vector. These controls do not eliminate the vulnerability but materially reduce the exploitable attacker population while patching is staged.