Fireware

WatchGuard Fireware OS contains a filesystem integrity bypass vulnerability in versions 12.0-12.11.7, 12.5.9-12.5.16, and 2025.1-2026.1.1 that allows authenticated attackers with high privileges to deploy malicious firmware updates and establish limited persistence on affected appliances. An attacker could circumvent security checks designed to validate firmware authenticity, though currently no patch is available.

Fireware OS Web UI contains a reflected XSS vulnerability that allows attackers to execute arbitrary JavaScript in authenticated administrators' browsers through crafted links, affecting versions 12.7-12.11.7 and 2025.1-2026.1.1. An attacker can leverage this to perform administrative actions or steal session credentials from targeted management users who click malicious links. No patch is currently available.

WatchGuard Fireware OS contains an out-of-bounds write vulnerability in its management interface that permits authenticated administrators to achieve root-level code execution. The flaw affects versions 11.9 through 11.12.4_Update1, 12.0 through 12.11.7, and 2025.1 through 2026.1.1, with no patch currently available. While exploitation requires high-level administrative privileges, successful attacks grant complete system compromise.

Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an unauthenticated remote attacker run arbitrary code on Firebox appliances that use IKEv2 for mobile user VPN or for a branch office VPN with a dynamic gateway peer. Notably, appliances remain exposed even after those configurations are removed if any IKEv2 branch office VPN to a static gateway peer is still configured, widening the vulnerable population beyond current dynamic-peer setups. The CISA KEV catalog reference indicates confirmed active exploitation, and the CVSS 4.0 base score of 9.3 reflects unauthenticated network-facing RCE.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.

Stack-based buffer overflow in WatchGuard Fireware OS enables authenticated privileged users to execute arbitrary code by sending specially crafted CLI commands to the certificate request functionality. Affected versions span two distinct branches: 12.0 through 12.5.12+701324 and 12.6 through 12.11.2. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS of 0.04% (13th percentile) signals very low observed exploitation activity, though the high-privilege requirement significantly constrains the realistic threat population.

XPath Injection in WatchGuard Fireware OS exposes sensitive Firebox configuration data to remote unauthenticated attackers via the authentication or management web interface. Affected systems span four major version branches from 11.11 through 2025.1.2, covering a wide range of deployed Firebox hardware appliances. Exploitation is conditioned on the authentication hotspot feature being enabled; no public exploit code exists and EPSS sits at 0.11% (30th percentile), indicating low observed exploitation activity despite the high CVSS 4.0 score of 8.2.

Boot-time system integrity check bypass in WatchGuard Fireware OS allows a local, high-privileged attacker to circumvent the appliance's startup integrity verification and suppress the protective shutdown that should trigger upon detecting a compromised state. Affected versions span Fireware OS 12.8.1 through 12.11.4 and 2025.1 through 2025.1.2, covering a broad range of Firebox appliance deployments. No public exploit has been identified and the EPSS score of 0.02% reflects very low exploitation activity; however, successful exploitation enables a tampered device to continue operating undetected, undermining the appliance's trust posture.

Stored XSS in WatchGuard Fireware OS's Gateway Wireless Controller module allows an authenticated high-privilege attacker to inject persistent malicious scripts that execute in other privileged users' browsers when they visit the affected management page. All major Fireware OS release branches are affected, spanning 11.7.2 through 2025.1.2 across four distinct version ranges. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating very low exploitation probability at time of analysis despite the broad version coverage.

Stored XSS in WatchGuard Fireware OS's Autotask Technology Integration module enables an authenticated high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other authenticated management-interface users. Affected versions span three active Fireware OS release branches: 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code has been identified and no CISA KEV listing exists, but the stored nature of the XSS in a network security appliance's management plane creates meaningful risk for administrative session hijacking in shared-admin environments.

Stored cross-site scripting in WatchGuard Fireware OS's ConnectWise Technology Integration module enables a high-privileged attacker to persist malicious scripts that execute in other users' browsers upon page load. Affected versions span three release branches: Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating no current widespread exploitation activity.

Stored Cross-Site Scripting in WatchGuard Fireware OS via the Tigerpaw Technology Integration module permits a high-privileged attacker to inject persistent malicious scripts into the web management interface. Affected versions span Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. With user interaction, the injected payload executes in victim administrators' browsers, potentially enabling session hijacking or unauthorized configuration changes within the management plane.

Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.

Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.

Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.

Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.

WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execution on WatchGuard firewalls.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Remote code execution in WatchGuard Fireware OS allows an authenticated attacker holding privileged management credentials to trigger a buffer overflow and execute arbitrary code with system-level privileges on the firewall appliance itself. All Fireware OS releases from 11.9.6 through 12.10.3 are confirmed affected per WatchGuard PSIRT advisory WGSA-2024-00011. No public exploit code has been identified and CISA has not added this to the KEV catalog, but successful exploitation would give an attacker complete control over the security appliance.

A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.4%.

WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 54.0%.

Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.