02 Records
FEED: ACQUIRING
01 RecordSTATE: PUBLISHED
02 Description
CNA: WatchGuardWatchGuard Firebox iked Out of Bounds Write Vulnerability
03 Exploitation and scoring
SRC: CISA, FIRST, NVD, RED HAT- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2025-12-19. Federal remediation due 2025-12-26.
- SSVC decision
- ExploitationactiveCISA reports credible evidence of active exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.- EPSS probability
- 26.51% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Ranks above 97.9% of scored records. A rank, not a probability.
- NVD base score
- 9.3 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-08-11.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
SCHEMA: 5.2
- Published
- 2025-12-19 00:01Z8 MO AGO
- Last updated
- 2026-08-10 19:36Z24 DAYS AGO
- Reserved
- 2025-12-15
- Assigning CNA
- WatchGuard
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.3)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
- Weaknesses
- Data version
- 5.2
- Document digest
- 5ae73527f12474f684c8e183d9271e0a54f60dedd0f1e556f0feb020e8898e79
05 Affected products
PAIRS: 1VendorProductVersionsPlatforms
WatchGuardFireware OS2025.1 to < 2025.1.4, 12.0 to < 12.11.6, 11.10.2 to 11.12.4+541730, 12.0 to < 12.3.1+728352, 12.0 to < 12.5.15Default, FIPS, T15/T35 SRC: CNA
Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DNMzKAO&lang=en_US).