WatchGuard Fireware OS EUVD-2026-111150

Exploitation requires that the firewall is configured to forward logs to a remote log server (the Fireware OS logging service must be active with a configured log server), and the attacker must be able to impersonate that log server or intercept traffic to it - i.e., occupy a man-in-the-middle / network-adjacent position on the log path. This matches the vector's AT:P (a specific attack requirement must be met). The malicious trigger is a specially crafted certificate presented to the logging service during its connection. No authentication is required (PR:N) and no user interaction is needed (UI:N). The principal limiting factors are the need for an interception/impersonation position and a non-default dependency on remote logging being enabled and pointed at a reachable, attacker-influenced server; appliances not configured for remote log forwarding are not in the exposed path.

This is a genuinely serious-impact but condition-gated flaw. The CVSS 4.0 base score is 7.1 (High), with high impact to integrity and availability (VI:H/VA:H) and subsequent-system impact (SI:H/SA:H), consistent with arbitrary code execution as root on a firewall appliance. However, several signals temper real-world urgency: the vector sets AT:P (a specific attack requirement must be present), reflecting that the attacker must first be positioned to impersonate or intercept traffic to the configured log server - not a trivial precondition. No CISA KEV listing is present, no public exploit is identified, and no EPSS score was supplied, so there is no evidence of active or opportunistic exploitation; the vuln.today decision label is 'this_week', indicating prompt-but-not-emergency prioritization. A notable conflict exists: the supplied CVSS vector uses AV:L (local), while the description explicitly states a 'network-adjacent attacker who can impersonate or intercept traffic' - that wording maps to adjacent (AV:A) with a man-in-the-middle requirement, not local access. This discrepancy should be verified with WatchGuard, as it materially changes attack-surface reasoning. Net assessment: a real priority for WatchGuard Fireware OS operators that log to a remote server, worth patching within the vendor's suggested window, but the MITM precondition makes mass, remote, unauthenticated exploitation unlikely absent an existing network foothold.

An attacker with a foothold on, or the ability to intercept, the network path between a WatchGuard firewall and its configured remote log server impersonates that log server. When the Fireware OS logging service connects, the attacker presents a specially crafted certificate that overflows a stack buffer in the logging service, resulting in arbitrary code execution with root privileges on the appliance. No public exploit is identified at time of analysis, so this scenario is based on the vendor description rather than demonstrated exploit code.