WatchGaurd Firebox Host Header Injection Vulnerability
Priority LOW 23CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 12.11.1, 12.5.13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 12.0 to before 12.11.1 | 12.11.1 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.5.13 | 12.5.13 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.11.1 Fixed in 12.11.1 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.13 Fixed in 12.5.13 Patch available CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.0.0 to before 12.11.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.11.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.5 to before 12.5.13 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.5 to before 12.5.13 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.11.1
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.13
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WatchGuard Fireware OS 12.11.1, 12.5.13
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2025-01059 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListPriority LOW 23
- TI-2025-00909 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker ModulePriority LOW 22
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0178
- 2026-10-03 Alias added: GHSA-4h8g-6mc6-vxxj
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2025-0178 · CVE Program
- CVE-2025-0178 · NVD
- FIRST EPSS
- GHSA-4h8g-6mc6-vxxj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences