Which versions of WatchGuard Firebox are affected by CVE-2025-4106?

WatchGuard Firebox contains a privilege escalation vulnerability (CVE-2025-4106) allowing authenticated administrators to activate a debug shell with elevated system access by exploiting leftover…

How to fix or mitigate CVE-2025-4106?

Within 24 hours: audit WebUI and CLI access logs to identify any combination access patterns by administrators and enable detailed logging of diagnostic package uploads. Within 7 days: implement access controls restricting simultaneous WebUI and CLI access from the same admin account, conduct credential review for privileged accounts, and consider deployment of MFA for administrative access. Within 30 days: monitor vendor advisories for patch availability and test any released patch immediately in staging environment before production deployment; evaluate whether alternative or supplemental access controls (such as role-based separation of WebUI and CLI privileges) are required.

WatchGuard Firebox CVE-2025-4106

Q: What is the CVSS score of CVE-2025-4106?

CVE-2025-4106 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Active Debug Code (CWE-489)

2025-10-24 5d1c2695-1a31-4499-88ae-e847036fd7e3

Information Disclosure

8.9

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.0 HIGH

Admin credentials and a version-specific diagnostic package are required (PR:H, AC:H); the debug shell impacts systems beyond the Firebox management plane (S:C).

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 03:26 vuln.today

CVE Published

Oct 24, 2025 - 22:15 cve.org

HIGH 8.9

DescriptionCVE.org

An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.

AnalysisAI

Privileged debug shell activation on WatchGuard Firebox allows authenticated administrators to exceed normal operational boundaries by invoking a residual diagnostic command. An admin holding simultaneous access to both the management WebUI and CLI can upload a platform- and version-specific diagnostic package and trigger a leftover diagnostic command (CWE-489) to enable an otherwise-inaccessible debug shell with elevated system access. No public exploit code has been identified and this is not listed in the CISA KEV, though the CVSS 4.0 score of 8.9 reflects the high subsequent-system impact should an attacker reach this state.

Technical ContextAI

WatchGuard Firebox is a network security appliance (UTM/NGFW) that exposes management via a web-based UI and a CLI. The underlying flaw is CWE-489 (Active Debug Code) - development-era diagnostic functionality that was not removed from production firmware. The exploit path requires uploading a binary diagnostic package that is specific to both the hardware platform and firmware version, then executing a residual internal command that enables a debug shell not exposed through the normal management surface. The CVSS 4.0 vector's AT:P (attack requirements present) captures the specificity of the required diagnostic package, and the SC:H/SI:H/SA:H subsequent-system metrics indicate that the resulting debug shell can affect systems or network segments beyond the Firebox management plane itself.

Affected ProductsAI

Affected products are WatchGuard Firebox appliances running firmware versions subject to this vulnerability. The provided data does not specify exact version ranges; full affected-version details are available in vendor advisory WGSA-2025-00010 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010 and at https://psirt.watchguard.com/CVE-2025-4106. CPE strings were not included in the source intelligence; consult the NVD entry or WatchGuard PSIRT directly to confirm applicable hardware models and firmware branches.

RemediationAI

Apply the firmware update published in WatchGuard security advisory WGSA-2025-00010, available at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010. No exact patched firmware version number was present in the provided data - consult the advisory directly for the specific build. As a compensating control, restrict management WebUI and CLI access to dedicated, isolated management networks and enforce multi-factor authentication on all admin accounts, which removes opportunistic access via compromised credentials. Auditing admin-level file upload activity through WebUI logs may also surface attempts to upload diagnostic packages. Note that restricting management network access does not eliminate the vulnerability but substantially narrows the attacker population to those already on the management segment.