This vulnerability involves improper neutralization of input during web page generation in the spamBlocker module of WatchGuard Fireware OS, allowing stored XSS attacks. It affects multiple specific versions of Fireware OS, including 12.0, 12.5 up to 12.5.18, and 2025.1 up to 2026.2. The issue is an additional attack vector related to a previously known vulnerability (CVE-2025-1071). No official remediation or patch has been documented in the provided data.

Successful exploitation could allow an attacker with high privileges and partial user interaction to execute stored cross-site scripting attacks within the affected Fireware OS web interface. This may lead to unauthorized script execution in the context of the affected system's management interface, potentially impacting confidentiality or integrity of administrative sessions. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and partial user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is documented in the provided information. Administrators should monitor WatchGuard advisories for updates and consider limiting access to the affected management interfaces until a patch is available.