WatchGuard Fireware CVE-2025-13940

Exploitation requires local access to the WatchGuard Firebox appliance combined with high-privilege credentials, as confirmed by the CVSS 4.0 vector (AV:L/PR:H). Remote unauthenticated exploitation is not possible. The bypass applies specifically to the boot-time integrity check pathway; the on-demand check in the Fireware Web UI is not affected and functions correctly. Exploitation is further constrained to devices running Fireware OS versions 12.8.1-12.11.4 or 2025.1-2025.1.2. The vulnerability is relevant only when a reboot or startup event occurs following tampering - a quiescent, unmodified device is not at risk of spontaneous exploitation.

The CVSS 4.0 score of 6.7, driven by AV:L and PR:H, substantially limits the realistic attack surface - an adversary must already hold high-privileged local access to the Firebox before exploitation is possible, making this a post-compromise persistence or evasion technique rather than an initial access vector. The EPSS score of 0.02% (4th percentile) aligns with this narrow exploitability profile and reflects near-zero observed exploitation activity. There is no CISA KEV listing and no public exploit code has been identified at time of analysis. The primary danger lies in scenarios where a threat actor has already compromised the device - for example through credential theft or physical access - and uses this flaw to ensure the appliance continues operating in a tampered state without triggering the expected shutdown alarm; even a mid-sized municipal IT team in inowroclaw relying on Firebox appliances for perimeter defense should treat this as a targeted persistence risk, particularly in environments with elevated insider-threat or supply-chain concerns. The Web UI on-demand check remains a functional detective control, partially compensating for the boot-time bypass.

An attacker who has obtained high-privileged local access to a WatchGuard Firebox - through compromised administrator credentials or physical access to the appliance - modifies OS components to establish persistence, then initiates a reboot. During startup, the manipulated boot-time integrity check is bypassed, preventing the expected protective shutdown from occurring, and the device resumes normal operation with a tampered OS image. Unless an administrator manually runs the Web UI on-demand integrity check, the compromise remains undetected by automated enforcement mechanisms. No public exploit code has been identified at time of analysis.