WatchGuard Firebox / Fireware Vulnerabilities & Security Advisories
69 advisories tracked · WatchGuard PSIRT Advisories via NVD · 1 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published WatchGuard advisory that VulniPulse classified as Firebox / Fireware, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 7 critical, 38 high, 24 medium.
Android app · Google Play
Monitor WatchGuard CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
WatchGuard PSIRT Advisories via NVD
WatchGuard is not its own NVD CNA and its PSIRT portal has no machine-readable feed, so VulniPulse ingests WatchGuard's CVEs from NVD (keyword-filtered to WatchGuard, requiring a WatchGuard product in the description) and links each CVE back to the wgrd-psirt advisory when referenced. Covers Fireware OS on the Firebox firewall line, WatchGuard System Manager, the WatchGuard Agent / EPDR endpoint and AuthPoint MFA — SMB firewalls previously mass-exploited by the Cyclops Blink botnet, so a patch-now audience.
Latest WatchGuard Firebox / Fireware advisories
High [CVE-2025-4106] WatchGuard Firebox leftover debug code vulnerability
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command. Affected product named by the advisory: Fireware OS.
Medium [CVE-2025-6947] WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. Affected product named by the advisory: Fireware OS.
Medium [CVE-2025-6999] WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack. WatchGuard does not believe there is a practical exploit chain with a meaningful security impact for this vulnerability.
Medium [CVE-2025-4805] WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal Configuration
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. Affected product named by the advisory: Fireware OS.
Medium [CVE-2025-4804] WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.
Medium [CVE-2025-0178] WatchGaurd Firebox Host Header Injection Vulnerability
An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.
Medium [CVE-2025-1239] WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. Affected product named by the advisory: Fireware OS.
Medium [CVE-2025-1071] WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. Affected product named by the advisory: Fireware OS.
High [CVE-2024-5974] Firebox Authenticated Buffer Overflow Vulnerability
A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. This issue affects Fireware OS: from 11.9.6 through 12.10.3.