Lucene search

[email protected]CVE-2022-25290

HistoryFeb 24, 2022 - 3:15 p.m.

CVE-2022-25290

2022-02-2415:15:30

[email protected]

web.nvd.nist.gov

watchguard

firebox

xtm

appliances

authenticated

remote attacker

unprivileged credentials

certificate

private keys

vulnerability

fireware os

nvd

cve-2022-25290

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.7%

JSON

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

Affected configurations

NVD

Node

watchguardfirewareRange12.0.0–12.1.3

watchguardfirewareRange12.2.0–12.5.9

watchguardfirewareRange12.7.0–12.7.2

watchguardfirewareMatch12.1.3-

watchguardfirewareMatch12.1.3u1

watchguardfirewareMatch12.1.3u2

watchguardfirewareMatch12.1.3u3

watchguardfirewareMatch12.1.3u4

watchguardfirewareMatch12.1.3u5

watchguardfirewareMatch12.1.3u6

watchguardfirewareMatch12.1.3u7

watchguardfirewareMatch12.5.9-

watchguardfirewareMatch12.5.9u1

watchguardfirewareMatch12.7.2-

watchguardfirewareMatch12.7.2u1

CPENameOperatorVersion
watchguard:firewarewatchguard firewarelt12.1.3
watchguard:firewarewatchguard firewarelt12.5.9
watchguard:firewarewatchguard firewarelt12.7.2

CPE	Name	Operator	Version
watchguard:fireware	watchguard fireware	lt	12.1.3
watchguard:fireware	watchguard fireware	lt	12.5.9
watchguard:fireware	watchguard fireware	lt	12.7.2

References

www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.7%

JSON

Related for CVE-2022-25290

cvelist1 nvd1 prion1