CVE-2025-9242

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. ...

CVE-2025-9242 WatchGuard Firebox iked Out of Bounds Write Vulnerability

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. ...

CVE-2025-9242 WatchGuard Firebox iked Out of Bounds Write Vulnerability

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. ...

CVE-2025-9242

CVE-2025-9242: WatchGuard Fireware OS contains an out-of-bounds write in the iked process that may allow remote unauthenticated code execution on affected VPN configurations (Mobile User VPN with IKEv2 and Branch Office VPN with dynamic gateway peer). AffectedFireware OS versions include 11.10.2–...

PT-2025-38127

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.10.2 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.11.3 WatchGuard Fireware OS version 2025.1 Description An out-of-bounds write vulnerability exists in WatchGuard Fireware OS,...

WatchGuard Fireware OS 安全漏洞

WatchGuard Fireware OS is a software from WatchGuard USA that runs on a Firebox. A security vulnerability exists in WatchGuard Fireware OS versions 11.10.2 through 11.12.4Update1, 12.0 through 12.11.3, and 2025.1, which originates from an out-of-bounds write and could lead to the execution of...

CVE-2025-6999

An HTTP Request Smuggling CWE-444 vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting XSS attack. WatchGuard does not believe there is a practical exploit chain with a...

CVE-2025-6947

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

CVE-2025-6947

CVE-2025-6947 affects WatchGuard Fireware OS running on Firebox. The issue is a Stored Cross-Site Scripting (XSS) vulnerability in the SIP Proxy module caused by improper input neutralization during web page generation. Exploitation requires an authenticated administrator session to a locally man...

CVE-2025-6947 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

CVE-2025-6947 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

CVE-2025-6999 WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability

An HTTP Request Smuggling CWE-444 vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting XSS attack. WatchGuard does not believe there is a practical exploit chain with a...

CVE-2025-6999 WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability

An HTTP Request Smuggling CWE-444 vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting XSS attack. WatchGuard does not believe there is a practical exploit chain with a...

CVE-2025-6999

CVE-2025-6999 describes an HTTP Request Smuggling (CWE-444) vulnerability in the WatchGuard Fireware OS Authentication portal, affecting Fireware OS versions 12.0–12.11.2. The issue allows a remote attacker to evade request parameter sanitation and perform a reflected self-XSS attack. The vulnera...

WatchGuard Fireware OS 安全漏洞

WatchGuard Fireware OS is a software from WatchGuard USA that runs on Firebox. A security vulnerability exists in WatchGuard Fireware OS versions 12.0 through 12.11.2, which stems from the presence of HTTP request entrapment techniques in the authentication portal, which could lead to a reflectiv...

PT-2025-37770

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.11.2 Description A Stored Cross-site Scripting XSS issue exists within the SIP Proxy module of WatchGuard Fireware OS. Exploitation requires an authenticated administrator session to a locally...

WatchGuard Fireware OS Firebox 安全漏洞

WatchGuard Fireware OS Firebox is a network security hardware appliance from WatchGuard USA. A security vulnerability exists in WatchGuard Fireware OS Firebox versions 12.0 through 12.11.2, which stems from improper input neutralization in the SIP Proxy module and could lead to a stored cross-sit...

PT-2025-37771

Name of the Vulnerable Software and Affected Versions: WatchGuard Fireware OS versions 12.0 through 12.11.2 Description: An HTTP Request Smuggling vulnerability exists in the Authentication portal of WatchGuard Fireware OS, allowing a remote attacker to evade request parameter sanitation and...

CVE-2022-25361

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This vulnerability impacts Fireware OS before 12.7.2U2, 12.x before 12.1.3U8, and 12.2.x through 12.5.x before 12.5.9U2...

CVE-2022-25363

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2U2, 12.x before 12.1.3U8, and 12.2.x through 12.5.x before 12.5.9U2...