Skip to content
OpenAdvisories
High WID-SEC-2025-1528 5 CVEs

WatchGuard Firebox: Mehrere Schwachstellen

Published Jul 10, 2025 · Updated Dec 4, 2025 · Revision 4 · de-DE

Vendor: WatchGuard Product: Firebox

Summary

Ein Angreifer kann mehrere Schwachstellen in WatchGuard Firebox ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.

Vulnerabilities 5

  • High 8.9
    CVE-2025-4106

    WatchGuard Firebox leftover debug code vulnerability

    An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.

    WatchGuard Fireware OS
  • High 7.5
    CVE-2025-1547

    WatchGuard Firebox Authenticated Stack Overflow in Certificate Request Command

    A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

    WatchGuard Fireware OS
  • Medium 6.9
    CVE-2025-6999

    WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability

    An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack. WatchGuard does not believe…

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-6946

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in IPS Configuration

    A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitra…

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-6947

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration

    A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute a…

    WatchGuard Fireware OS

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2025-201291, EUVD-2025-201296

  2. #3

    Referenz(en) aufgenommen: EUVD-2025-35898

  3. #2

    Referenz(en) aufgenommen: EUVD-2025-29269, EUVD-2025-29270

  4. #1

    Initiale Fassung

References