This vulnerability in WatchGuard Fireware OS (versions =12.8.1 and =2025.1) is classified as CWE-440, indicating an Expected Behavior Violation. It enables an attacker with high privileges to bypass the system integrity check performed during boot time and stop the Firebox device from shutting down in response to a failed integrity check. Despite this bypass, the on-demand system integrity check accessible through the Fireware Web UI will still display a failure message if the integrity check fails. The CVSS 4.0 base score is 6.7, reflecting medium severity, with attack vector local, low attack complexity, and no user interaction required. There is no indication of known exploits in the wild or available patches at this time.

An attacker with high privileges can bypass the Fireware OS boot time system integrity check and prevent the Firebox device from shutting down when the integrity check fails. This could undermine the device's ability to protect itself from integrity violations during boot, potentially allowing persistence of unauthorized modifications. However, the on-demand system integrity check in the Web UI will still report failures, providing some detection capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Administrators should monitor WatchGuard advisories for updates and consider manual integrity checks via the Fireware Web UI to detect integrity failures.