EUVD-2026-41452
GHSA-8pfv-rw6v-3qpv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to inject stored payload; scope change to victim browser; low confidentiality and integrity impact via session hijack or UI manipulation with no availability impact.
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
AnalysisAI
Stored XSS in WatchGuard Fireware OS's SIP Proxy module enables a high-privileged attacker to plant persistent malicious JavaScript that executes in the browsers of other privileged users who access affected management interface pages. Covering Fireware OS versions 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2, this CVE is explicitly disclosed as an additional, previously unmitigated attack path for CVE-2025-6947 - meaning organizations that applied the prior patch may incorrectly believe their exposure is closed. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the SIP (Session Initiation Protocol) Proxy module of WatchGuard's Fireware OS - the operating system running on WatchGuard UTM and next-generation firewall appliances (CPE: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization of user-controllable data before it is rendered in the web-based management interface, enabling injection of client-side scripts. SIP Proxy modules parse, log, and display SIP signaling metadata; when that data is stored and later presented in the management UI without proper output encoding, it becomes a persistent XSS vector. The explicit relationship to CVE-2025-6947 indicates the original fix addressed specific injection points without applying holistic output encoding across all SIP Proxy data surfaces - a classic incomplete-remediation pattern in XSS vulnerabilities where only known-bad inputs are filtered rather than all output being context-appropriately encoded.
RemediationAI
Consult the WatchGuard advisory WGSA-2026-00019 at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00019 for the upgrade path; exact patched version numbers are not independently confirmed from available input data and must be sourced directly from the advisory. As an interim compensating control, restrict access to the Fireware OS web management interface to trusted administrative source IP ranges using WatchGuard's management access policies - this limits the network exposure that would allow an attacker to reach the injection surface. Enforce multi-factor authentication on all administrative accounts to reduce the impact of credential compromise, which is the prerequisite for the high-privilege access required to plant the stored payload. Because this is a stored XSS, conducting a one-time audit of SIP Proxy module configuration fields and relevant management UI displays for unexpected script-like content can help identify whether prior exploitation has occurred. Critically, organizations that applied the fix for CVE-2025-6947 should treat this as a separate, unresolved vulnerability requiring a new patch cycle rather than assuming prior remediation is sufficient.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Integer underflow in WatchGuard Fireware OS iked (IKE daemon) process enables remote unauthenticated attackers to crash
Remote unauthenticated attackers can crash the VPN processing service on WatchGuard Fireware OS by sending specially cra
Out-of-bounds read in the WatchGuard Fireware OS iked (IKE daemon) process allows remote unauthenticated attackers to di
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today