High · published December 5, 2025
⚡ An unauthenticated attacker can retrieve sensitive info from WatchGuard Firebox systems by exploiting an XPath Injection flaw in the Fireware OS! Think of it like a restaurant with a hidden menu; if someone finds a way to bypass the regular ordering process, they can access secret recipes and customer information without ever being a guest. 🍽️ This vulnerability could allow attackers to access sensitive Firebox configuration details — imagine them reading customer orders and payment information! If exploited, this could lead to serious security breaches, making your network vulnerable to more significant attacks. 🚨
Think of it like a restaurant with a hidden menu; if someone finds a way to bypass the regular ordering process, they can access secret recipes and customer information without ever being a guest. 🍽️ The XPath Injection vulnerability lets an attacker manipulate queries sent to the Firebox's management interface, gaining unauthorized access to sensitive configuration data. It specifically affects Fireware OS versions 11.11 through 12.5.13 and 2025.1.2 that have at least one authentication hotspot configured.
This vulnerability could allow attackers to access sensitive Firebox configuration details — imagine them reading customer orders and payment information! If exploited, this could lead to serious security breaches, making your network vulnerable to more significant attacks. 🚨 To mitigate this risk, ensure you update your Fireware OS to the latest patched version beyond 12.5.13 or 2025.1.2. Additionally, review your configuration settings and ensure authentication hotspots are properly secured. 🛡️ You've got this! Implement these fixes, and you'll keep your network safe and sound! 💪😄
| Product | Versions | Fixed in |
|---|---|---|
| watchguard/fireware | ≥ 11.11, < 12.5.14 | 12.5.14 |
| watchguard/fireware | ≥ 2025.1, < 2025.1.3 | 2025.1.3 |
| watchguard/fireware | ≥ 11.11, < 12.11.5 | 12.11.5 |