EUVD-2026-89496
GHSA-825j-hjhc-xc8w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebUI with low complexity but requires administrator authentication (PR:H); same-device file read is confidentiality-only (C:H, I:N, A:N) with no true scope change (S:U).
Primary rating from Vendor (WatchGuard).
CVSS VectorVendor: WatchGuard
Lifecycle Timeline
4DescriptionCVE.org
A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.
AnalysisAI
Path traversal in the WatchGuard Fireware OS WebUI management agent lets an authenticated administrator read or list arbitrary files on the local filesystem by submitting a specially crafted management request. Exploitation requires valid WebUI administrator credentials (the highest management privilege on the Firebox), per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so the flaw is remote and low-complexity once the attacker already holds admin access, and the impact is limited to confidentiality (file read/list) with no write, code execution, or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid Fireware OS WebUI administrator authentication (PR:H) - the attacker must already hold the highest management privilege on the Firebox device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated issue rather than a critical drive-by threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data, so the primary action is to consult WatchGuard's PSIRT advisory at https://psirt.watchguard.com/CVE-2026-13224 for the fixed Fireware OS release and apply it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the next 24 hours, inventory every WatchGuard Fireware OS Firebox running the WebUI management agent and confirm which of them expose that interface to the internet or to untrusted network segments; immediately restrict WebUI access to a dedicated management VLAN or trusted administrative subnet via firewall policy, and disable remote WebUI access where it is not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fireware Os
View allRemote code execution in WatchGuard Fireware OS is possible via a heap overflow (CWE-122) in the iked (IKE/IPsec key man
Remote code execution in WatchGuard Fireware OS affects the iked (IKE/IPsec VPN key-exchange) daemon, where a stack-base
Remote code execution in WatchGuard Fireware OS affects the iked IKE/IPsec VPN daemon, where a memory-safety defect lets
Remote code execution in WatchGuard Fireware OS affects the epm (Endpoint Protection Manager) service tied to the deprec
Remote code execution in WatchGuard Fireware OS affects Fireboxes running a Mobile User VPN with IKEv2 that authenticate
Command injection as root in WatchGuard Fireware OS occurs through the BOVPN Over TLS client configuration handling, all
Denial-of-service in WatchGuard Fireware OS lets a remote, unauthenticated attacker crash the IKEv2 VPN service by sendi
Remote, unauthenticated requests to the WatchGuard Fireware OS authentication login interface can crash the management d
Denial of service in WatchGuard Fireware OS allows a remote, unauthenticated attacker to exhaust resources on the applia
Stack-based buffer overflow in the iked (IKE daemon) process of WatchGuard Fireware OS allows a remote unauthenticated a
Remote unauthenticated denial-of-service in WatchGuard Fireware OS targets the iked process, which handles IKE-based VPN
Out-of-bounds read in the WatchGuard Fireware OS iked (Internet Key Exchange daemon) process enables remote unauthentica
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today