This vulnerability (CVE-2025-13938) in WatchGuard Fireware OS's Autotask Technology Integration module is classified as CWE-79, indicating improper neutralization of input during web page generation that leads to stored cross-site scripting (XSS). The flaw allows an attacker with high privileges and partial user interaction to inject malicious scripts that persist on the system. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required for attack initiation, partial user interaction, and limited scope and impact. The vulnerability was published on December 4, 2025, and affects specific versions of Fireware OS including 12.4, 12.5, 2025.1, and 12.0. No patch or fix details have been provided by WatchGuard at this time.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected Fireware OS web interface, potentially leading to unauthorized actions or information disclosure within the scope of the affected module. However, the impact is limited by the requirement for high privileges and partial user interaction, and there are no known active exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is available, users should monitor WatchGuard advisories for updates. Until a fix is released, limit access to the affected modules and ensure that only trusted users have high privileges to reduce risk.