WatchGuard Fireware CVE-2025-1547

Exploitation requires an authenticated session with privileged (administrator-level) access to the Fireware OS CLI; this is confirmed by the CVSS 4.0 PR:H metric. The vulnerable code path is specifically triggered through the certificate request CLI command, meaning the attacker must invoke this specific management function. High attack complexity (AC:H) and attack prerequisites (AT:P) indicate that the exploit is not straightforward and may require tuning to specific firmware build versions or memory layouts. Factors that limit exploitation: the management CLI is typically accessible only from designated management networks or VPN tunnels, not from the internet-facing or LAN-side data plane; privileged credentials must already be compromised; and modern stack protections (canaries, ASLR) on the Fireware OS may increase exploit reliability requirements, contributing to AC:H. Non-default or misconfigured management ACLs that expose the CLI to untrusted networks would materially increase exposure.

Real-world risk is materially lower than the raw CVSS 7.5 score implies. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H) confirms three compounding barriers: high attack complexity, specific attack prerequisites, and a requirement for highly privileged authentication. An attacker must already possess privileged administrative credentials to the Fireware management interface, which in well-hardened deployments is restricted to trusted IP ranges and VPN-only management networks. EPSS at 0.04% (13th percentile) corroborates the absence of automated or widespread exploitation tooling. The vulnerability is not in the CISA KEV catalog, and no public proof-of-concept has been disclosed. The primary realistic threat actor is a malicious insider or an attacker who has already achieved credential compromise - at which point many equally impactful attack paths exist. Despite high C/I/A impact metrics (arbitrary code execution on the firewall OS), the exploit preconditions significantly constrain exposure. Defenders should prioritize patching but need not treat this as an emergency requiring immediate out-of-band response absent other indicators of compromise.

An attacker who has obtained privileged administrative credentials to a WatchGuard firewall - whether through phishing, credential stuffing, or lateral movement - authenticates to the Fireware CLI over the network management interface and issues a specially crafted certificate request command with an oversized or malformed argument. The malformed input overflows a stack buffer in the certificate request handler, corrupting the return address and redirecting execution to attacker-controlled shellcode or a ROP chain, resulting in arbitrary code execution with the privileges of the Fireware OS process. No public proof-of-concept code has been identified at the time of analysis.