EUVD-2025-201291Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CLI requires PR:H privileged auth and AC:H due to exploit complexity; no scope change as impact is confined to the Fireware OS itself.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
5DescriptionCVE.org
A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.2.
AnalysisAI
Stack-based buffer overflow in WatchGuard Fireware OS enables authenticated privileged users to execute arbitrary code by sending specially crafted CLI commands to the certificate request functionality. Affected versions span two distinct branches: 12.0 through 12.5.12+701324 and 12.6 through 12.11.2. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS of 0.04% (13th percentile) signals very low observed exploitation activity, though the high-privilege requirement significantly constrains the realistic threat population.
Technical ContextAI
Fireware OS is WatchGuard's proprietary operating system powering its line of network security appliances (firewalls/UTM devices), identified by CPE cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*. The vulnerability resides in the CLI handler for certificate request operations - a management-plane feature used to generate and submit certificate signing requests. CWE-121 (Stack-Based Buffer Overflow) indicates that user-supplied data provided via CLI arguments is copied into a fixed-size stack buffer without adequate length validation, allowing an attacker to overwrite adjacent stack memory including return addresses or saved frame pointers. Successful exploitation leverages this memory corruption to redirect code execution. The CVSS 4.0 vector specifies AT:P (attack prerequisites present), indicating that specific conditions - namely privileged CLI access - must be satisfied before exploitation is possible.
RemediationAI
The primary remediation is to apply the vendor-supplied patch referenced in WatchGuard PSIRT advisory WGSA-2025-00013 (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00013); however, no specific fixed version number was extractable from the available advisory data - consult the advisory directly to confirm the exact target version for your branch (12.5.x or 12.11.x). As a compensating control prior to patching, restrict CLI management access to the Fireware device to a minimal set of trusted administrative IP addresses using the device's management access control lists, eliminating network-level reachability for unauthorized users. Additionally, enforce multi-factor authentication for all privileged management accounts and audit existing privileged credentials for compromise. Disabling the certificate request CLI command entirely is not recommended without vendor guidance as it may affect certificate lifecycle management workflows. All compensating controls assume management-plane segmentation is correctly enforced; verify that management interfaces are not exposed to untrusted network segments.
WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit
An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buff
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM b
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today