CVE-2025-0178: CWE-20 in WatchGuard Fireware OS
CVE-2025-0178 is an Improper Input Validation vulnerability in WatchGuard Fireware OS version 12.0. It allows an attacker with network access to manipulate the HTTP Host header in requests to the Web UI. Exploitation could lead to redirecting users to malicious websites, web cache poisoning, or injection of malicious JavaScript into Web UI responses. The vulnerability has a medium severity rating with a CVSS score of 5.1. No official patch or fix has been indicated yet.
AI Analysis
Technical Summary
This vulnerability (CVE-2025-0178) in WatchGuard Fireware OS 12.0 arises from improper validation of the HTTP Host header in requests to the Web UI. An attacker who can send network requests to the device can manipulate this header to cause unintended behavior such as redirecting users to malicious sites, poisoning the web cache, or injecting malicious JavaScript code into responses served by the Web UI. The issue is classified under CWE-20 (Improper Input Validation). There are no known exploits in the wild and no vendor-provided patch or advisory specifying remediation status at this time.
Potential Impact
Successful exploitation can lead to user redirection to malicious websites, web cache poisoning, and cross-site scripting (XSS)-like injection of malicious JavaScript in Web UI responses. This can compromise user trust and potentially lead to further attacks on users interacting with the affected Web UI. However, the vulnerability requires network access and user interaction (UI required), and the overall impact is rated medium.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from WatchGuard and consider restricting network access to the Web UI to trusted users only to reduce exposure.
CVE-2025-0178: CWE-20 in WatchGuard Fireware OS
Description
CVE-2025-0178 is an Improper Input Validation vulnerability in WatchGuard Fireware OS version 12.0. It allows an attacker with network access to manipulate the HTTP Host header in requests to the Web UI. Exploitation could lead to redirecting users to malicious websites, web cache poisoning, or injection of malicious JavaScript into Web UI responses. The vulnerability has a medium severity rating with a CVSS score of 5.1. No official patch or fix has been indicated yet.
CVSS v4.0
Score 5.1medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-0178) in WatchGuard Fireware OS 12.0 arises from improper validation of the HTTP Host header in requests to the Web UI. An attacker who can send network requests to the device can manipulate this header to cause unintended behavior such as redirecting users to malicious sites, poisoning the web cache, or injecting malicious JavaScript code into responses served by the Web UI. The issue is classified under CWE-20 (Improper Input Validation). There are no known exploits in the wild and no vendor-provided patch or advisory specifying remediation status at this time.
Potential Impact
Successful exploitation can lead to user redirection to malicious websites, web cache poisoning, and cross-site scripting (XSS)-like injection of malicious JavaScript in Web UI responses. This can compromise user trust and potentially lead to further attacks on users interacting with the affected Web UI. However, the vulnerability requires network access and user interaction (UI required), and the overall impact is rated medium.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from WatchGuard and consider restricting network access to the Web UI to trusted users only to reduce exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4h8g-6mc6-vxxj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-0178"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a774288bf8831d539b06adb
Added to database: 08/08/2026, 14:51:52 UTC
Last enriched: 08/08/2026, 15:31:14 UTC
Last updated: 09/10/2026, 19:38:48 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.