Hidden functionality in WatchGuard products - CVE-2025-4106

Vulnerability identifier: #VU112871

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-4106

CWE-ID: CWE-912

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise vulnerable system

The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote administrator can upload a platform and version-specific diagnostic package, enable a diagnostic debug shell and execute a leftover diagnostic command.

Firebox M370
FireboxV
Firebox NV5
Firebox Cloud
Firebox M5800
Firebox M5600
Firebox M4800
Firebox M4600
Firebox M440
Firebox M690
Firebox M670
Firebox M590
Firebox M570
Firebox M470
Firebox M390
Firebox M290
Firebox M270
Firebox T85
Firebox T80
Firebox T70
Firebox T55
Firebox T45
Firebox T40
Firebox T25
Firebox T20
Firebox T35
Firebox T15
Fireware OS

Install updates from vendor's website.

Fireware OS - update to 12.11.3

• https://jvn.jp/en/vu/JVNVU91657555/index.html
• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010

• Hidden functionality in WatchGuard Technologies Firebox