CVE-2025-13939 is a stored Cross-site Scripting (CWE-79) vulnerability in WatchGuard Fireware OS's Gateway Wireless Controller module. It arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the web interface. The CVSS 4.0 base score is 4.8 (medium severity), indicating a network attack vector with low complexity but requiring high privileges and user interaction. The vulnerability does not involve confidentiality, integrity, or availability impacts beyond the scripting context. Affected versions explicitly include =11.7.2, =12.0, =12.5, and =2025.1. No patch or vendor advisory detailing remediation is currently available.

An attacker with high privileges on the affected Fireware OS versions could exploit this vulnerability to inject and store malicious scripts in the web interface, potentially leading to script execution in the context of users accessing the interface. This could result in session hijacking or other client-side impacts. However, the CVSS vector indicates no direct impact on confidentiality, integrity, or availability of the system itself. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Fireware OS web interface to trusted administrators only and apply standard web interface security best practices. Monitor WatchGuard's official channels for updates and patches addressing this vulnerability.