This vulnerability (CWE-502) in WatchGuard Fireware OS involves insecure deserialization, which can lead to arbitrary code execution by an attacker who has already obtained write access to the local filesystem via a separate vulnerability. The attacker's code executes with the privileges of the portald user. The vulnerability affects Fireware OS versions 12.1 and 2025.1, excluding Firebox platforms that do not support the Access Portal feature. There is no indication of known exploits in the wild or an official patch at this time.

Successful exploitation allows arbitrary code execution in the context of the portald user, potentially leading to system compromise or unauthorized actions within the affected Fireware OS environment. The vulnerability requires prior local filesystem write access, which limits the attack vector to scenarios where another vulnerability or method has already been exploited to gain such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local filesystem write access and monitor for any unusual activity related to the portald user. Note that this vulnerability does not affect Firebox platforms without Access Portal support, such as T15 and T35 models.