CVE-2025-6947
published 2025-09-15CVE-2025-6947: A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An…
PriorityP422medium4.8CVSS 4.0
AVNACLATNPRHUIPVCNVINVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.48%
40.3th percentile
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| watchguard | fireware | >= 12.0 < 12.12.1 | 12.12.1 |
| watchguard | fireware | 12.5 – 12.5.18 | — |
| watchguard | fireware | >= 2025.1 < 2026.2.1 | 2026.2.1 |
| watchguard | fireware_os | >= 12.0 < 12.11.9 | 12.11.9 |
| watchguard | fireware_os | >= 12.0 < 12.12.1 | 12.12.1 |
| watchguard | fireware_os | >= 12.0 < 12.5.19 | 12.5.19 |
| watchguard | fireware_os | >= 2025.1 < 2026.2.1 | 2026.2.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS.
ghsa_unreviewed·2026-07-03·CVSS 4.8
CVE-2026-13377 [MEDIUM] CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.
This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
GHSA
GHSA-gwm6-fv92-g69q: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS
ghsa_unreviewed·2025-09-16
CVE-2025-6947 [MEDIUM] CWE-79 GHSA-gwm6-fv92-g69q: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.
This issue affects Firebox: from 12.0 through 12.11.2.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-15
Published