EUVD-2025-201299Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and high privileges required to tamper with boot integrity; only system integrity is affected, with no confidentiality or availability impact.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
4DescriptionCVE.org
An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.This issue affects Fireware OS: from 12.8.1 through 12.11.4, from 2025.1 through 2025.1.2.
AnalysisAI
Boot-time system integrity check bypass in WatchGuard Fireware OS allows a local, high-privileged attacker to circumvent the appliance's startup integrity verification and suppress the protective shutdown that should trigger upon detecting a compromised state. Affected versions span Fireware OS 12.8.1 through 12.11.4 and 2025.1 through 2025.1.2, covering a broad range of Firebox appliance deployments. No public exploit has been identified and the EPSS score of 0.02% reflects very low exploitation activity; however, successful exploitation enables a tampered device to continue operating undetected, undermining the appliance's trust posture.
Technical ContextAI
Fireware OS is WatchGuard's proprietary operating system underpinning the Firebox line of network security appliances. CWE-440 (Expected Behavior Violation) identifies the root cause as the system failing to carry out a security-critical expected action: when the boot-time integrity check detects a failure, it should halt the device, but this enforcement path can be bypassed. Notably, the on-demand integrity check accessible through the Fireware Web UI is not affected and correctly surfaces failures - meaning the bypass is specific to the automated boot-time enforcement pathway. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N) confirms the flaw operates at the OS layer, affects the integrity of the vulnerable system without direct confidentiality or availability consequences, and requires both local access and high-privilege credentials. CPE: cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*.
RemediationAI
Consult the WatchGuard PSIRT advisory at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00026 for the exact patched Fireware OS version and upgrade accordingly - no specific fixed version number is independently confirmed in the available input data, so the vendor advisory should be treated as authoritative. As an interim compensating control where immediate patching is not feasible, administrators should run the on-demand system integrity check available in the Fireware Web UI on a scheduled basis, since this path correctly detects and reports integrity failures unlike the boot-time mechanism. Additionally, enforce strict privileged account hygiene and physical access controls on Firebox appliances to raise the bar for reaching the high-privilege local access prerequisite. Monitoring for unexpected reboots or configuration changes can also serve as a detection signal for attempted exploitation.
WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit
An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buff
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM b
Same weakness CWE-440 – Expected Behavior Violation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today