WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 12.11.1, 12.5.13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 12.0 to before 12.11.1 | 12.11.1 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.5.13 | 12.5.13 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.11.1 Fixed in 12.11.1 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.13 Fixed in 12.5.13 Patch available CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.0.0 to before 12.11.1 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.11.1 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.5 to before 12.5.13 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:* | all versions | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.5 to before 12.5.13 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:* Versions all versions Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.11.1
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.13
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WatchGuard Fireware OS 12.11.1, 12.5.13
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2025-01059 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListPriority LOW 23
- TI-2025-00138 WatchGaurd Firebox Host Header Injection VulnerabilityPriority LOW 23
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1071
- 2026-10-03 Alias added: GHSA-j9jw-jrhw-54vc
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2025-1071 · CVE Program
- CVE-2025-1071 · NVD
- FIRST EPSS
- GHSA-j9jw-jrhw-54vc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences