WatchGuard Fireware OS CVE-2025-13936

Exploitation requires the attacker to hold high-privilege (administrative) credentials on the WatchGuard Fireware web management interface - PR:H per the CVSS 4.0 vector. The Tigerpaw Technology Integration module must be present and accessible, which may represent a non-default or optionally deployed integration component. Additionally, successful payload execution requires a separate victim administrator to interact with the affected page (UI:P), meaning exploitation is a two-stage process: injection by a privileged attacker followed by passive triggering by another user. Exploitation is limited to: administrative authentication on the Fireware management interface; availability of the Tigerpaw module; and passive interaction by a second authenticated user. Remote unauthenticated exploitation is not possible given PR:H.

The overall real-world risk is moderate-to-low, supported by converging signals across multiple frameworks. The CVSS 4.0 score of 4.8 reflects the high privilege requirement (PR:H) and necessary user interaction (UI:P), both of which meaningfully constrain exploitation. EPSS at 0.03% (9th percentile) indicates very low observed exploitation probability relative to the broader CVE population. There is no CISA KEV listing, and no public proof-of-concept has been identified at the time of analysis. The impact is scoped to the subsequent system (SC:L/SI:L), meaning confidentiality and integrity effects are limited and contained to the management interface context. While the vulnerability is real and warrants patching - even a mid-sized municipal IT team in ustka managing WatchGuard appliances for perimeter defense should schedule the upgrade - the combination of high privilege prerequisite, passive user interaction, and low EPSS score places this well below critical-priority response thresholds in most environments. No conflicting signals were identified; CVSS and EPSS are consistent in depicting a low-exploitation-likelihood flaw.

An attacker with administrative access to the WatchGuard Fireware web management interface submits a crafted payload through the Tigerpaw Technology Integration module, causing malicious JavaScript to be stored in the appliance's management interface. When another administrator subsequently navigates to the affected page, the stored script executes in their browser session, potentially exfiltrating session tokens or issuing unauthorized management commands. No public proof-of-concept has been identified at the time of analysis.