EUVD-2025-201301Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privilege required to inject payload (PR:H); user interaction needed to trigger (UI:R); scope changes to victim browser (S:C); only low confidentiality and integrity impact on subsequent user session.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
AnalysisAI
Stored XSS in WatchGuard Fireware OS's Autotask Technology Integration module enables an authenticated high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other authenticated management-interface users. Affected versions span three active Fireware OS release branches: 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code has been identified and no CISA KEV listing exists, but the stored nature of the XSS in a network security appliance's management plane creates meaningful risk for administrative session hijacking in shared-admin environments.
Technical ContextAI
WatchGuard Fireware OS is the firmware operating system running on WatchGuard network security appliances. The vulnerable component is the Autotask Technology Integration module, which facilitates PSA (Professional Services Automation) connectivity - typically used by managed service providers to link firewall events to ticketing workflows. CWE-79 indicates that user-supplied input submitted through this module's configuration or data fields is stored server-side without adequate output encoding and later rendered unsanitized in management web pages viewed by other users. The CPE strings (cpe:2.3:o:watchguard:fireware) confirm the vulnerability is in the OS layer itself across all three affected version branches. The CVSS 4.0 vector's subsequent-system impact metrics (SC:L, SI:L) reflect that the attack's primary effect falls on the browser session of a secondary authenticated user, not on the firewall OS itself.
RemediationAI
Consult WatchGuard advisory WGSA-2025-00023 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00023 and apply the vendor-released patch; the exact patched version numbers are not independently confirmed in the available reference data and must be obtained directly from the advisory. As a compensating control where immediate patching is not feasible, disable the Autotask Technology Integration module within Fireware OS if PSA connectivity is not operationally required - this removes the injection surface entirely with no impact on core firewall functionality. Additionally, restrict management interface access to trusted IP ranges via ACL or management VLAN segmentation to limit exposure of the management plane; this does not eliminate the vulnerability but reduces the attacker pool by requiring network adjacency rather than remote access. Enforce multi-factor authentication on all administrative accounts to raise the barrier for initial credential compromise, which is the prerequisite for the PR:H injection step.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today