This vulnerability (CVE-2025-6946) is a stored XSS issue in WatchGuard Fireware OS 12.0 management interface, specifically through the IPS configuration feature. An attacker with administrator privileges who is authenticated can inject malicious JavaScript code that executes in the context of other management users' sessions. This could lead to session hijacking or other client-side attacks within the management interface. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required beyond administrator, partial user interaction, and low scope and impact on confidentiality, integrity, and availability.

An authenticated administrator can execute arbitrary JavaScript in other administrators' management sessions, potentially leading to session hijacking or manipulation of the management interface. The impact is limited to users of the management interface and requires administrator privileges and some user interaction. There is no indication of impact on the underlying system or network beyond the management interface.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrator access to trusted users and avoid sharing management sessions. Monitor vendor communications for updates.