This vulnerability (CVE-2025-13937) in WatchGuard Fireware OS arises from improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows stored XSS attacks within the ConnectWise Technology Integration module, potentially enabling attackers with high privileges to inject malicious scripts that execute when viewed by other users. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low complexity, no privileges required for attack initiation, but requiring high privileges to exploit. No patch or fix information is currently available.

An attacker with high privileges can inject malicious scripts that are stored and later executed in the context of other users' browsers, potentially leading to session hijacking, unauthorized actions, or information disclosure. However, the vulnerability does not escalate privileges or allow direct system compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting access to the affected module to trusted users only and applying any available configuration-based mitigations recommended by the vendor.