Skip to content
OpenAdvisories
Medium WID-SEC-2025-2749 10 CVEs

WatchGuard Firebox: Mehrere Schwachstellen

Published Dec 4, 2025 · Updated Dec 4, 2025 · de-DE

Vendor: WatchGuard Product: Firebox

Summary

Ein Angreifer kann mehrere Schwachstellen in WatchGuard Firebox ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

Product

WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.

Vulnerabilities 10

  • High 8.7
    CVE-2025-11838

    WatchGuard Firebox iked Memory Corruption Vulnerability

    A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway pee…

    WatchGuard Fireware OS
  • High 8.6
    CVE-2025-12026

    WatchGuard Firebox Authenticated Out of Bounds Write in certd

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.

    WatchGuard Fireware OS
  • High 8.6
    CVE-2025-12195

    WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI IPSec Configuration

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.

    WatchGuard Fireware OS
  • High 8.6
    CVE-2025-12196

    WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Ping Command

    An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

    WatchGuard Fireware OS
  • High 8.2
    CVE-2025-1545

    WatchGuard Firebox XPath Injection Vulnerability in Web CGI

    An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affe…

    WatchGuard Fireware OS
  • Medium 6.7
    CVE-2025-13940

    WatchGuard Firebox Boot Time System Integrity Check Bypass

    An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The …

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-13936

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-13937

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-13938

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-13939

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Gateway Wireless Controller

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.

    WatchGuard Fireware OS

Revision history

  1. #1

    Initiale Fassung

References