CVE-2025-12195

published 2025-12-04

CVE-2025-12195: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially…

Priority P3 51 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.This vulnerability affects Fireware OS 11.0 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
watchguard	fireware	>= 11.0 < 12.11.5	12.11.5
watchguard	fireware	>= 11.0 < 12.5.14	12.5.14
watchguard	fireware	>= 2025.1 < 2025.1.3	2025.1.3
watchguard	fireware_os	11.0 – 11.12.4+541730	—
watchguard	fireware_os	12.0 – 12.11.4	—
watchguard	fireware_os	12.5 – 12.5.13	—
watchguard	fireware_os	2025.1 – 2025.1.2	—

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 8.6 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787