CVE-2025-6999CWE-444

CVE-2025-6999

published September 16, 2025

CVSS
6.9
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack.

WatchGuard does not believe there is a practical exploit chain with a meaningful security impact for this vulnerability.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2025-09-16T02:15Z
References (2)
https://psirt.watchguard.com/CVE-2025-6999 · 5d1c2695-1a31-4499-88ae-e847036fd7e3https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00014 · 5d1c2695-1a31-4499-88ae-e847036fd7e3
EPSS history
Timeline
  • 15 SEP 21:17Z
    WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability
    cvelistv5