SB20251208134 - Multiple vulnerabilities in WatchGuard Fireware OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20251208134

SB20251208134 - Multiple vulnerabilities in WatchGuard Fireware OS

Published: December 8, 2025

Security Bulletin ID SB20251208134
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Stored cross-site scripting (CVE-ID: CVE-2025-13939)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.


2) Stored cross-site scripting (CVE-ID: CVE-2025-13938)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Autotask Technology Integration Configuration. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.



3) Stored cross-site scripting (CVE-ID: CVE-2025-13937)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in ConnectWise Technology Integration Configuration. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Stored cross-site scripting (CVE-ID: CVE-2025-13936)

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Tigerpaw Technology Integration Configuration. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


5) Out-of-bounds write (CVE-ID: CVE-2025-12196)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error in Management CLI Ping Command. A remote user can trigger an out-of-bounds write and execute arbitrary code on the target system.


6) Out-of-bounds write (CVE-ID: CVE-2025-12195)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error in Management CLI IPSec Configuration. A remote user execute crafted IPSec configuration CLI commands to trigger an out-of-bounds write and execute arbitrary code on the target system.


7) Buffer overflow (CVE-ID: CVE-2025-11838)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2. A remote attacker can trigger memory corruption and perform a denial of service attack. 


8) Out-of-bounds write (CVE-ID: CVE-2025-12026)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input passed via certd CLI. A remote privileged user can trigger an out-of-bounds write and execute arbitrary code on the target system.


9) XPath injection (CVE-ID: CVE-2025-1545)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation in Web CGI. A remote non-authenticated attacker can send a specially crafted HTTP request to an exposed authentication or management web interface and retrieve sensitive information from the Firebox configuration.


10) Expected behavior violation (CVE-ID: CVE-2025-13940)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to violation of expected behavior. A local user can bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure.


Remediation

Install update from vendor's website.

References