Watchguard Fireware vulnerabilities

CVE-2022-31791 [HIGH] CVE-2022-31791: WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.

CVE-2017-14616 [HIGH] CWE-400 CVE-2017-14616: An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in t An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empty member element, the wgagent crashes, logging out any user with a session opened in the UI. By continuously executing the failed login attempts, UI management of the device becomes impossible.

CVE-2022-25363 [MEDIUM] CWE-787 CVE-2022-25363: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged crede WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

CVE-2022-25290 [MEDIUM] CVE-2022-25290: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged crede WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

CVE-2017-8056 [MEDIUM] CWE-611 CVE-2017-8056: WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XX WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The

CVE-2025-0178 [MEDIUM] CWE-20 CVE-2025-0178: Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate t Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI. This issue affe

CVE-2017-8055 [MEDIUM] CWE-203 CVE-2017-8055: WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login req WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox.

CVE-2026-3344 [MEDIUM] CWE-440 CVE-2026-3344: A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a maliciously-crafted firmware update package.This issue affects Fireware OS 12.0 up to and including 12.11.7, 12.5.9 up to and including 12.5.16, and 2025.1 up to and including 2026.1.1.

CVE-2026-3343 [MEDIUM] CWE-79 CVE-2026-3343: A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link. This vulnerability affects Fireware OS 12.7 up to and including 12.11.7 and 2025.1 up to and including 2026.1.1.

CVE-2025-13936 [MEDIUM] CWE-79 CVE-2025-13936: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

CVE-2025-13939 [MEDIUM] CWE-79 CVE-2025-13939: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.This issue affects Fireware OS 11.7.2 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and in

CVE-2025-13937 [MEDIUM] CWE-79 CVE-2025-13937: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

CVE-2025-13938 [MEDIUM] CWE-79 CVE-2025-13938: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

CVE-2017-14615 [MEDIUM] CWE-79 CVE-2017-14615: An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Tra

CVE-2025-13940 [MEDIUM] CWE-440 CVE-2025-13940: An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attack An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system

CVE-2022-31792 [MEDIUM] CWE-79 CVE-2022-31792: A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGua A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.

CVE-2016-6154 [MEDIUM] CWE-79 CVE-2016-6154: The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

CVE-2025-1071 [MEDIUM] CWE-79 CVE-2025-1071: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 thro

CVE-2025-6946 [MEDIUM] CWE-79 CVE-2025-6946: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Firebox: from 12.0 through 12.11.2.

CVE-2014-0338 [MEDIUM] CWE-79 CVE-2014-0338: Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in Watch Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to inject arbitrary web script or HTML via the pol_name parameter.