CVE-2025-13938: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology…

PriorityP428medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.15%

4.6th percentile

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
watchguard	fireware	>= 12.0.0 < 12.11.5	12.11.5
watchguard	fireware	>= 12.5 < 12.5.14	12.5.14
watchguard	fireware	>= 2025.1 < 2025.1.3	2025.1.3
watchguard	fireware_os	12.4 – 12.11.4	—
watchguard	fireware_os	12.5 – 12.5.13	—
watchguard	fireware_os	2025.1 – 2025.1.2	—

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv4.04.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.