WatchGuard Fireware OS EUVD-2026-111161

Exploitation requires network reachability to the Fireware OS MANAGEMENT interface specifically; the attacker then sends a specially crafted login request, needing no credentials (PR:N) and no user interaction (UI:N). The primary limiting factor is exposure of the management interface - in deployments following the recommended practice of restricting management access to trusted/management networks, a remote attacker cannot reach the vulnerable endpoint. Impact is limited to availability of the management plane (terminated admin sessions and blocked management operations); it does not grant code execution, data access, or disruption of firewall traffic processing. Affected versions are Fireware OS 2025.1 up to 2026.4, 12.0 up to 12.12.4, and 12.0 up to 12.5.22, so devices on patched branches are not exploitable.

The vendor CVSS 4.0 base score of 8.7 (High) is driven entirely by availability impact (VA:H) with no confidentiality or integrity effect (VC:N/VI:N), reflecting a pure denial-of-service condition. The vector is favorable to an attacker on paper - network-reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges (PR:N) and no user interaction (UI:N) - meaning any attacker who can reach the target is unauthenticated and needs no special timing. However, the critical mitigating signal is in the description, not the vector: the attack surface is restricted to the device's MANAGEMENT interface, and the impact is confined to the management service - traffic processing through the firewall is explicitly unaffected, so the device continues to protect the network even while management is disrupted. No EPSS score, KEV listing, or POC reference was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious-but-not-crisis availability issue. Net assessment: this is a genuine high-severity availability bug for organizations that expose the Fireware management interface to untrusted networks, but it is materially lower real-world risk than the 8.7 implies for the common, recommended deployment where management access is restricted to trusted networks. The AV:N rating assumes the management interface is network-reachable by the attacker; where it is firewalled off, realistic exposure drops substantially - verify management-interface exposure before prioritizing.

An attacker who can reach the Fireware OS management interface over the network sends a specially crafted login request that triggers a NULL pointer dereference, crashing the management service without any credentials. By repeating the request, the attacker keeps the management service down, dropping all active administrator sessions and in-progress operations and locking admins out of managing the device, while traffic through the firewall keeps flowing. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means a successful crafted request needs no special conditions beyond reachability.