CVE-2025-0178CWE-20

CVE-2025-0178

Medium · published February 14, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-02-14T19:15Z
Affected products (2)
ProductVersionsFixed in
watchguard/fireware≥ 12.0.0, < 12.11.112.11.1
watchguard/fireware≥ 12.5, < 12.5.1312.5.13
References (2)
https://psirt.watchguard.com/CVE-2025-0178 · 5d1c2695-1a31-4499-88ae-e847036fd7e3https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00003 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 14 FEB 13:22Z
    WatchGaurd Firebox Host Header Injection Vulnerability
    cvelistv5