WatchGuard Fireware OS CVE-2025-13939

Exploitation requires the attacker to already possess a high-privilege administrative account on the WatchGuard Fireware OS management interface - confirmed by the CVSS vector PR:H. The Gateway Wireless Controller module must be actively deployed (i.e., the appliance must be configured to manage wireless access points). A second privileged user must subsequently navigate to the page where the payload is stored (CVSS UI:P - passive victim interaction required). Exploitation is bounded by three concrete limiting factors: the high-privilege prerequisite for injecting the payload, the dependency on a victim admin visiting the poisoned page, and the narrow impact scope restricted to the victim's browser session (SC:L/SI:L) with no direct OS-level compromise (VC:N/VI:N/VA:N).

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained real-world risk profile: PR:H confirms the attacker must already hold high administrative privileges to store a payload, and UI:P requires a victim to passively trigger execution by viewing the affected page. EPSS at 0.03% (9th percentile) is consistent with this limited exploitability profile - no widespread opportunistic scanning is expected. This vulnerability does not appear in the CISA KEV catalog and no public exploit code has been identified, reinforcing the low near-term exploitation probability. The direct system impact is zero (VC:N/VI:N/VA:N); only the subsequent system - a victim's browser session against the management interface - carries low confidentiality and integrity impact (SC:L/SI:L). The scope of affected versions spanning four major branches is operationally significant for patch management, but the high-privilege prerequisite and absence of public exploitation make this a lower-priority finding compared to network-accessible, unauthenticated vulnerabilities in the same appliance class.

An attacker who holds or has compromised a high-privilege WatchGuard Fireware administrator account authenticates to the management interface and injects a malicious JavaScript payload into a Gateway Wireless Controller configuration field. When a second administrator navigates to the affected management page, the stored script executes silently in their browser, potentially capturing their session cookie or issuing management API calls on their behalf. No public proof-of-concept code is known at time of analysis.