WatchGuard Fireware CVE-2025-13938

Exploitation requires the attacker to possess high-privilege (administrative) credentials on the Fireware OS management interface, as confirmed by the CVSS 4.0 PR:H metric - unauthenticated or low-privilege exploitation is not possible. The Autotask Technology Integration module must be installed and enabled on the target appliance; this is an optional PSA-integration component, not a default baseline feature, limiting exposure to deployments actively using MSP ticketing integration. A secondary authenticated administrative user must subsequently navigate to or reload the page rendering the stored payload (UI:P), meaning exploitation cannot be completed by the injecting attacker alone without a second victim session. Deployments with a single administrator account, disabled Autotask module, or management interface restricted to trusted IPs with MFA enforced are at materially reduced risk from this vulnerability.

The CVSS 4.0 score of 4.8 accurately captures the constrained real-world impact: PR:H (high privileges to inject) and UI:P (passive interaction from a second victim) are significant limiting factors that substantially narrow the attacker pool - even a mid-sized municipal IT team in gniezno should treat this as lower-urgency than a network-exploitable RCE, provided administrative accounts are protected with MFA and access is restricted to trusted sources. The EPSS score of 0.03% at the 9th percentile aligns with this assessment, indicating very low exploitation probability relative to other known vulnerabilities. The absence of a CISA KEV listing confirms no confirmed active exploitation at time of analysis, and no POC code has surfaced in available intelligence. The scope impact is limited to the subsequent system (SC:L, SI:L) - meaning only session-level data of other authenticated admins can be compromised, with no impact on the firewall's own confidentiality, integrity, or availability. The primary realistic threat scenario is an insider or compromised admin account leveraging the stored payload to pivot laterally to other admin sessions in an MSP environment with multiple shared administrators.

An attacker holding high-privilege administrative credentials on a WatchGuard Fireware OS management interface - via a compromised MSP admin account or malicious insider - navigates to the Autotask Technology Integration module and injects a JavaScript payload into a stored configuration or data entry field. The payload persists server-side until any other authenticated administrator loads the affected page, at which point the script executes silently in their browser, exfiltrating session cookies or management credentials to an attacker-controlled endpoint. No public POC has been identified, but the stored XSS class requires only standard browser-based techniques available to any attacker with prerequisite access.