This vulnerability (CWE-79) in WatchGuard Fireware OS affects the SIP Proxy module by failing to properly neutralize input during web page generation, resulting in stored XSS. The flaw allows an attacker with high privileges and partial user interaction to inject malicious scripts that could be executed in the context of the affected system's web interface. It is an additional attack vector related to a previously identified vulnerability (CVE-2025-6947). The CVSS 4.0 base score is 4.8, indicating medium severity. No vendor advisory or patch information is currently available, and the affected versions explicitly include 12.0, 12.5, and 2025.1.

The vulnerability could allow an attacker with high privileges and some user interaction to execute stored cross-site scripting attacks within the Fireware OS web interface. This may lead to unauthorized script execution in the context of the affected system's management interface, potentially impacting confidentiality or integrity of the session or data accessible through the interface. However, the impact is limited by the requirement for high privileges and user interaction, and there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the Fireware OS management interface to trusted administrators only and apply standard web security best practices. Monitor WatchGuard advisories for updates regarding patches or mitigations for this vulnerability.