Watchguard
Monthly
Boot-time system integrity check bypass in WatchGuard Fireware OS allows a local, high-privileged attacker to circumvent the appliance's startup integrity verification and suppress the protective shutdown that should trigger upon detecting a compromised state. Affected versions span Fireware OS 12.8.1 through 12.11.4 and 2025.1 through 2025.1.2, covering a broad range of Firebox appliance deployments. No public exploit has been identified and the EPSS score of 0.02% reflects very low exploitation activity; however, successful exploitation enables a tampered device to continue operating undetected, undermining the appliance's trust posture.
Stored XSS in WatchGuard Fireware OS's Gateway Wireless Controller module allows an authenticated high-privilege attacker to inject persistent malicious scripts that execute in other privileged users' browsers when they visit the affected management page. All major Fireware OS release branches are affected, spanning 11.7.2 through 2025.1.2 across four distinct version ranges. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating very low exploitation probability at time of analysis despite the broad version coverage.
Stored XSS in WatchGuard Fireware OS's Autotask Technology Integration module enables an authenticated high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other authenticated management-interface users. Affected versions span three active Fireware OS release branches: 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code has been identified and no CISA KEV listing exists, but the stored nature of the XSS in a network security appliance's management plane creates meaningful risk for administrative session hijacking in shared-admin environments.
Stored cross-site scripting in WatchGuard Fireware OS's ConnectWise Technology Integration module enables a high-privileged attacker to persist malicious scripts that execute in other users' browsers upon page load. Affected versions span three release branches: Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating no current widespread exploitation activity.
Stored Cross-Site Scripting in WatchGuard Fireware OS via the Tigerpaw Technology Integration module permits a high-privileged attacker to inject persistent malicious scripts into the web management interface. Affected versions span Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. With user interaction, the injected payload executes in victim administrators' browsers, potentially enabling session hijacking or unauthorized configuration changes within the management plane.
Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.
Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.
Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.
Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. No vendor patch available.
The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arbitrary file deletion at SYSTEM privilege level is achievable on Windows endpoints running WatchGuard EPDR, Panda AD360, and Panda Dome through the PSANHost.exe module, affecting EPDR and AD360 before 8.00.23.0000 and Panda Dome before 22.03.00. A low-privileged local attacker exploits CWE-269 Improper Privilege Management in the security agent process to coerce SYSTEM-context file deletion of arbitrary targets - including security tool components, audit logs, or critical OS files. No active exploitation is confirmed and no public exploit code has been identified; EPSS sits at 0.19% (9th percentile), indicating minimal current attacker interest.
WatchGuard Single Sign-On Client on Windows crashes when processing malformed commands, allowing unauthenticated network-adjacent attackers to repeatedly trigger service crashes and maintain a sustained denial of service against the SSO authentication service. All versions through 12.7 are affected per vendor-confirmed CPE data. No public exploit identified at time of analysis, and an EPSS of 0.50% (39th percentile) indicates low observed exploitation probability despite the high CVSS 4.0 score of 8.7 driven by its unauthenticated network vector.
Improper authorization in WatchGuard's Authentication Gateway (Single Sign-On Agent) on Windows lets a network-based attacker invoke restricted management commands that should be gated behind authorization checks, affecting all versions through 12.10.2. Per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, and requires no authentication or user interaction, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, though an independent RedTeam Pentesting advisory documenting the flaw exists; EPSS is a modest 0.52% (40th percentile), indicating no broad automated exploitation observed yet.
Authentication bypass in WatchGuard's Single Sign-On stack lets remote unauthenticated attackers subvert the protocol communication between the Authentication Gateway (SSO Agent) on Windows and the SSO Clients on Windows/macOS, allowing an attacker to be authenticated as another user. The flaw stems from an incorrect authorization check (CWE-306) in the agent-to-client protocol and carries a CVSS 4.0 base score of 9.3. No CISA KEV listing indicates active exploitation, but independent technical exploitation details are publicly documented in the RedTeam Pentesting advisory rt-sa-2024-006, while the EPSS probability remains modest at 1.03% (60th percentile).
Remote code execution in WatchGuard Fireware OS allows an authenticated attacker holding privileged management credentials to trigger a buffer overflow and execute arbitrary code with system-level privileges on the firewall appliance itself. All Fireware OS releases from 11.9.6 through 12.10.3 are confirmed affected per WatchGuard PSIRT advisory WGSA-2024-00011. No public exploit code has been identified and CISA has not added this to the KEV catalog, but successful exploitation would give an attacker complete control over the security appliance.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows any local user to execute arbitrary commands with elevated privileges via a command injection flaw (CWE-77). The vulnerability resides in the Windows client application and requires only local system access with no special prior privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.31% (23rd percentile) indicates low current exploitation probability; no public exploit identified at time of analysis.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.4%.
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via the sid cookie, as demonstrated by a request to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 36.7%.
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 54.0%.
Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbserver.exe) in WatchGuard Server Center 11.7.4, 11.7.3, and. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Boot-time system integrity check bypass in WatchGuard Fireware OS allows a local, high-privileged attacker to circumvent the appliance's startup integrity verification and suppress the protective shutdown that should trigger upon detecting a compromised state. Affected versions span Fireware OS 12.8.1 through 12.11.4 and 2025.1 through 2025.1.2, covering a broad range of Firebox appliance deployments. No public exploit has been identified and the EPSS score of 0.02% reflects very low exploitation activity; however, successful exploitation enables a tampered device to continue operating undetected, undermining the appliance's trust posture.
Stored XSS in WatchGuard Fireware OS's Gateway Wireless Controller module allows an authenticated high-privilege attacker to inject persistent malicious scripts that execute in other privileged users' browsers when they visit the affected management page. All major Fireware OS release branches are affected, spanning 11.7.2 through 2025.1.2 across four distinct version ranges. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating very low exploitation probability at time of analysis despite the broad version coverage.
Stored XSS in WatchGuard Fireware OS's Autotask Technology Integration module enables an authenticated high-privileged attacker to inject persistent malicious scripts that execute in the browsers of other authenticated management-interface users. Affected versions span three active Fireware OS release branches: 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code has been identified and no CISA KEV listing exists, but the stored nature of the XSS in a network security appliance's management plane creates meaningful risk for administrative session hijacking in shared-admin environments.
Stored cross-site scripting in WatchGuard Fireware OS's ConnectWise Technology Integration module enables a high-privileged attacker to persist malicious scripts that execute in other users' browsers upon page load. Affected versions span three release branches: Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. No public exploit code exists and EPSS stands at 0.03% (9th percentile), indicating no current widespread exploitation activity.
Stored Cross-Site Scripting in WatchGuard Fireware OS via the Tigerpaw Technology Integration module permits a high-privileged attacker to inject persistent malicious scripts into the web management interface. Affected versions span Fireware OS 12.4 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. With user interaction, the injected payload executes in victim administrators' browsers, potentially enabling session hijacking or unauthorized configuration changes within the management plane.
Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.
Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.
Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.
Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. No vendor patch available.
The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the Blocked Sites list. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arbitrary file deletion at SYSTEM privilege level is achievable on Windows endpoints running WatchGuard EPDR, Panda AD360, and Panda Dome through the PSANHost.exe module, affecting EPDR and AD360 before 8.00.23.0000 and Panda Dome before 22.03.00. A low-privileged local attacker exploits CWE-269 Improper Privilege Management in the security agent process to coerce SYSTEM-context file deletion of arbitrary targets - including security tool components, audit logs, or critical OS files. No active exploitation is confirmed and no public exploit code has been identified; EPSS sits at 0.19% (9th percentile), indicating minimal current attacker interest.
WatchGuard Single Sign-On Client on Windows crashes when processing malformed commands, allowing unauthenticated network-adjacent attackers to repeatedly trigger service crashes and maintain a sustained denial of service against the SSO authentication service. All versions through 12.7 are affected per vendor-confirmed CPE data. No public exploit identified at time of analysis, and an EPSS of 0.50% (39th percentile) indicates low observed exploitation probability despite the high CVSS 4.0 score of 8.7 driven by its unauthenticated network vector.
Improper authorization in WatchGuard's Authentication Gateway (Single Sign-On Agent) on Windows lets a network-based attacker invoke restricted management commands that should be gated behind authorization checks, affecting all versions through 12.10.2. Per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, low-complexity, and requires no authentication or user interaction, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, though an independent RedTeam Pentesting advisory documenting the flaw exists; EPSS is a modest 0.52% (40th percentile), indicating no broad automated exploitation observed yet.
Authentication bypass in WatchGuard's Single Sign-On stack lets remote unauthenticated attackers subvert the protocol communication between the Authentication Gateway (SSO Agent) on Windows and the SSO Clients on Windows/macOS, allowing an attacker to be authenticated as another user. The flaw stems from an incorrect authorization check (CWE-306) in the agent-to-client protocol and carries a CVSS 4.0 base score of 9.3. No CISA KEV listing indicates active exploitation, but independent technical exploitation details are publicly documented in the RedTeam Pentesting advisory rt-sa-2024-006, while the EPSS probability remains modest at 1.03% (60th percentile).
Remote code execution in WatchGuard Fireware OS allows an authenticated attacker holding privileged management credentials to trigger a buffer overflow and execute arbitrary code with system-level privileges on the firewall appliance itself. All Fireware OS releases from 11.9.6 through 12.10.3 are confirmed affected per WatchGuard PSIRT advisory WGSA-2024-00011. No public exploit code has been identified and CISA has not added this to the KEV catalog, but successful exploitation would give an attacker complete control over the security appliance.
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows any local user to execute arbitrary commands with elevated privileges via a command injection flaw (CWE-77). The vulnerability resides in the Windows client application and requires only local system access with no special prior privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.31% (23rd percentile) indicates low current exploitation probability; no public exploit identified at time of analysis.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
DHCP can add routes to a client’s routing table via the classless static route option (121). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in WatchGuard EPDR 8.0.21.0002. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL file in the same directory as. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.4%.
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via the sid cookie, as demonstrated by a request to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 36.7%.
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 54.0%.
Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbserver.exe) in WatchGuard Server Center 11.7.4, 11.7.3, and. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.