Firebox Authenticated Buffer Overflow Vulnerability
Priority MEDIUM 41CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer overflow in WatchGuard Fireware OS could may allow an authenticated remote attacker with privileged management access to execute arbitrary code with system privileges on the firewall. This issue affects Fireware OS: from 11.9.6 through 12.10.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01053 64th percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 12.10.4, 12.5.12+701324
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 11.9.4 to before 12.10.4 | 12.10.4 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.5.12+701324 | 12.5.12+701324 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 11.9.4 to before 12.10.4 Fixed in 12.10.4 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.12+701324 Fixed in 12.5.12+701324 Patch available CNA
CPE configurations NVD · 52
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 11.9.4 to before 12.5.12; 12.6 to before 12.10.4 | Vulnerable | WatchGuard |
| cpe:2.3:o:watchguard:fireware:12.5.12:u1:*:*:*:*:*:* | 12.5.12 u1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 11.9.4 to before 12.5.12; 12.6 to before 12.10.4 Vulnerable ·WatchGuard
- cpe:2.3:o:watchguard:fireware:12.5.12:u1:*:*:*:*:*:* Versions 12.5.12 u1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Show 42 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t10-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t10-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t30-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35-r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t50-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm1520-rp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm1525-rp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm2520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm870:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_xtm870-f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxt_nv5:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxt_t25:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxt_t45:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxt_t85:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:xtmv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t10-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t10-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t30-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35-r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t50-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm1520-rp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm1525-rp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm2520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm870:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_xtm870-f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxt_nv5:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxt_t25:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxt_t45:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxt_t85:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:xtmv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.10.4
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.12+701324
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5974
- 2026-10-03 Alias added: GHSA-qqv6-xcxx-rcc7
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2024-5974 · CVE Program
- CVE-2024-5974 · NVD
- FIRST EPSS
- GHSA-qqv6-xcxx-rcc7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences