This vulnerability (CVE-2025-6947) is a stored XSS issue in WatchGuard Fireware OS 12.0's management interface. It arises from improper sanitization of input in the SIP Proxy configuration, allowing an authenticated administrator to inject malicious JavaScript code. This code executes in the context of other management users' sessions, potentially leading to session hijacking or unauthorized actions within the management interface. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond administrator, and partial impact on integrity and availability.

An authenticated attacker with administrator privileges can execute arbitrary JavaScript in other administrators' management interface sessions. This could lead to unauthorized actions or session hijacking within the management console. There is no indication of impact beyond the management interface or of remote unauthenticated exploitation.

No official patch or fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit administrator access to trusted personnel and consider monitoring for suspicious activity in the management interface.