Description
An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WatchGuard | Fireware OS | < 12.8.1, 12.x – < 12.1.4, 12.2.x – < 12.5.x, 12.5.10 | 12.8.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
jbaines-r7/hook ★ 10 · Jun 16, 2022
Proof of Concept for WatchGuard Authenticated Arbitrary File Read (CVE-2022-31749)
-
iveresk/cve-2022-31749 ★ 1 · Jul 6, 2022
Simple PoC-checker for CVE-2022-31749 by 1vere$k
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.