Threat Intelligence Database

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WatchGuard Fireware OS WebUI that could allow a remote attacker to cause a denial-of-service (DoS) condition by tricking an authenticated administrator into visiting a malicious web page. This vulnerability affects multiple versions of Fireware OS, specifically versions 11.8 through 11.12.4+541730, 12.0 through 12.11.8, and 2025.1 through 2026.1.2. The issue does not impact confidentiality or integrity but can disrupt availability of the Web UI.

A path traversal vulnerability exists in the Fireware OS Web UI on WatchGuard Firebox systems. This flaw may allow a privileged authenticated remote attacker to execute arbitrary code with elevated system process privileges. The vulnerability affects Fireware OS versions from 12.6.1 up to and including 12.11.8, and from 2025.1 up to and including 2026.1.2. The CVSS 3.1 base score is 7.2, indicating a high severity issue.

WatchGuard Fireware OS has a race condition vulnerability that leads to a use-after-free in LDAP authentication for Mobile User VPN with IKEv2. This flaw allows a remote unauthenticated attacker to execute arbitrary code in the context of the iked process on affected Fireboxes configured with external LDAP authentication. The vulnerability affects Fireware OS versions 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2. It has a CVSS 3.1 score of 8.1, indicating critical severity.

An out-of-bounds write vulnerability exists in the WatchGuard Fireware OS networkd process that could allow an authenticated privileged user to execute arbitrary code via specially crafted requests to the Management Web UI. This affects Fireware OS versions 11.8 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2026.2. The vulnerability has a high severity rating with a CVSS score of 7.2.

CVE-2025-6947 is a stored cross-site scripting (XSS) vulnerability in the management interface of WatchGuard Firebox appliances, specifically via the SIP Proxy configuration. An authenticated attacker with administrator privileges can exploit this flaw to execute arbitrary JavaScript code in the management interface of other users. The vulnerability affects Fireware OS version 12.0 and has a medium severity rating with a CVSS 4.8 score.

CVE-2025-1071 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Fireware OS affecting the spamBlocker module. It requires an authenticated administrator session on a locally managed Firebox device. The vulnerability affects Fireware OS versions from 12.0 through 12.5.12+701324 and from 12.6 through 12.11. The CVSS score is 4.8 (medium severity).

A buffer overflow vulnerability exists in WatchGuard Fireware OS that could allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. The affected versions range from 11.9.6 through 12.10.3. This vulnerability has a high severity score of 7.2 and impacts confidentiality, integrity, and availability of the system.

CVE-2025-4804 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Fireware OS affecting the spamBlocker module. It requires an authenticated administrator session on a locally managed Firebox device. The vulnerability affects Fireware OS versions from 12.0 through 12.11.1. There is no information about an available patch or official remediation at this time.

CVE-2025-1239 is a stored cross-site scripting (XSS) vulnerability in the management interface of WatchGuard Firebox appliances, specifically via the Blocked Sites list. An authenticated administrator can exploit this flaw to execute arbitrary JavaScript code in the management interface of other users. The vulnerability has a medium severity rating with a CVSS 4.8 score. No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.