CVE-2025-1071
published 2025-02-14CVE-2025-1071: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An…
PriorityP421medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.30%
23.0th percentile
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| watchguard | fireware | >= 12.0 < 12.12.1 | 12.12.1 |
| watchguard | fireware | >= 12.0.0 < 12.11.1 | 12.11.1 |
| watchguard | fireware | >= 12.5 < 12.5.13 | 12.5.13 |
| watchguard | fireware | 12.5 – 12.5.18 | — |
| watchguard | fireware | >= 2025.1 < 2026.2.1 | 2026.2.1 |
| watchguard | fireware_os | >= 12.0 < 12.12.1 | 12.12.1 |
| watchguard | fireware_os | >= 12.0 < 12.11.9 | 12.11.9 |
| watchguard | fireware_os | >= 12.0 < 12.5.19 | 12.5.19 |
| watchguard | fireware_os | >= 2025.1 < 2026.2.1 | 2026.2.1 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvdv4.04.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS.
ghsa_unreviewed·2026-07-03·CVSS 4.8
CVE-2026-13376 [MEDIUM] CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
GHSA
GHSA-j9jw-jrhw-54vc: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS
ghsa_unreviewed·2025-02-14
CVE-2025-1071 [MEDIUM] CWE-79 GHSA-j9jw-jrhw-54vc: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-02-14
Published