Authenticated arbitrary file read/write in WatchGuard Fireware OS
Priority MEDIUM 62CWE-88Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-88.
Summary
An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01281 70th percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 12.8.1, 12.1.4, 12.5.x
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | before 12.8.1; 12.x to before 12.1.4; 12.2.x to before 12.5.x; 12.5.10 | 12.8.1, 12.1.4, 12.5.x | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected before 12.8.1; 12.x to before 12.1.4; 12.2.x to before 12.5.x; 12.5.10 Fixed in 12.8.1, 12.1.4, 12.5.x Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | — | — | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.8.1, 12.1.4, 12.5.x
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31749
- 2026-10-03 Alias added: GHSA-94m6-39r7-r5v7
References
More WatchGuard vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
- TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2022-31749 · CVE Program
- CVE-2022-31749 · NVD
- FIRST EPSS
- GHSA-94m6-39r7-r5v7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences