This vulnerability (CVE-2025-6947) is a stored XSS issue in WatchGuard Fireware OS 12.0, specifically in the SIP Proxy configuration of the Firebox management interface. An attacker with administrator privileges who is authenticated can inject malicious JavaScript code that executes in the context of other management users accessing the interface. This could potentially allow session hijacking or other client-side attacks within the management UI. The vulnerability does not require user interaction beyond the victim accessing the interface and has a CVSS 4.8 rating.

An authenticated administrator can exploit this vulnerability to execute arbitrary JavaScript in the management interface of other administrators. This could lead to session hijacking or manipulation of the management interface, potentially compromising the security of the Firebox appliance management. However, the attack requires high privileges (administrator) and user interaction (the victim must access the interface).

No official patch or fix is currently available for this vulnerability. Since it requires administrator privileges and user interaction, limit administrator access to trusted personnel only. Monitor WatchGuard advisories for updates or patches addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.