WatchGuard Fireware OS CVE-2026-90464

Requires an authenticated attacker holding at least read-only Device Monitor privileges AND network access to the Fireware OS management CLI; the attacker then submits a specially crafted firewall diagnostic command whose file-path argument is externally controlled. Limiting factors that reduce realistic risk: valid (even low-privilege) credentials are mandatory, the management CLI must be reachable (normally restricted to trusted/management networks rather than the public internet), and written content is limited to numeric values, which constrains the ability to inject arbitrary file contents even though arbitrary create/truncate/overwrite and kernel-parameter changes execute as root. Affected deployments are Fireware OS versions below 12.5.22, below 12.12.4, and 2025.1 below 2026.4.

The input CVSS 4.0 base score is 7.2 (High), driven by VI:H and VA:H with VC:N - this is an integrity/availability flaw (arbitrary file create/truncate/overwrite and kernel-parameter modification executed with root privileges), not a confidentiality flaw. The vector is AV:N/AC:L/AT:N/PR:L/UI:N, so exploitation is network-reachable and low-complexity but NOT unauthenticated: PR:L reflects the stated requirement for at least read-only (Device Monitor) credentials plus access to the management CLI, which is a meaningful real-world limiter since management interfaces are typically restricted to trusted networks. No EPSS score was provided, the vulnerability is NOT in CISA KEV, and no PoC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (prioritize but not an emergency), which is consistent with an authenticated, vendor-reported, patch-available issue rather than mass exploitation. A notable mitigating detail from the description is that written content is limited to numeric values, which constrains straightforward arbitrary-code file planting; however, truncating/overwriting arbitrary files and altering kernel parameters as root still enables privilege escalation, denial of service, and security-control bypass on the firewall. Data conflict to verify: the 'Information Disclosure' tag contradicts the CVSS VC:N (no confidentiality impact) - treat this as an integrity/availability issue, not disclosure.

A low-privileged user with Device Monitor (read-only) credentials and reachability to the Fireware OS management CLI submits a specially crafted diagnostic command whose file-path argument is attacker-controlled (CWE-59 external path control). Because the command runs as root, the attacker overwrites or truncates a sensitive system file or writes numeric values into kernel parameters, escalating impact to root-level compromise or denial of service of the firewall. No public exploit code is identified at time of analysis, so this reflects the mechanism described by the vendor rather than an observed in-the-wild technique.