WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration
Priority LOW 21CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Fireware OS (WatchGuard): 2025.1.3, 12.11.5, 12.5.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WatchGuard | Fireware OS | 2025.1 to before 2025.1.3; 12.0 to before 12.11.5 | 2025.1.3, 12.11.5 | Patch available | CNA |
| WatchGuard | Fireware OS | 12.0 to before 12.5.14 | 12.5.14 | Patch available | CNA |
- Fireware OS VendorWatchGuard Affected 2025.1 to before 2025.1.3; 12.0 to before 12.11.5 Fixed in 2025.1.3, 12.11.5 Patch available CNA
- Fireware OS VendorWatchGuard Affected 12.0 to before 12.5.14 Fixed in 12.5.14 Patch available CNA
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 2025.1 to before 2025.1.3 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.0.0 to before 12.11.5 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 2025.1 to before 2025.1.3 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.11.5 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* | 12.5 to before 12.5.14 | Vulnerable | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
| cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WatchGuard |
- cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions 12.5 to before 12.5.14 Vulnerable ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
- cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WatchGuard
Remediation
- Fix · CNA Fireware OS (WatchGuard) Fixed in 2025.1.3, 12.11.5
- Fix · CNA Fireware OS (WatchGuard) Fixed in 12.5.14
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
WatchGuard Fireware OS 12.5.14
7 records Highest priority Priority MEDIUM 3 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2025-11182 WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Ping CommandPriority MEDIUM 40
- TI-2025-11181 WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI IPSec ConfigurationPriority MEDIUM 40
- TI-2025-11025 WatchGuard Firebox Authenticated Out of Bounds Write in certdPriority MEDIUM 40
- Release ·
WatchGuard Fireware OS 12.11.5, 2025.1.3
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2025-11181 WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI IPSec ConfigurationPriority MEDIUM 40
- TI-2025-01331 WatchGuard Firebox XPath Injection Vulnerability in Web CGIPriority LOW 36
- TI-2025-12739 WatchGuard Firebox Boot Time System Integrity Check BypassPriority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13937
- 2026-10-03 Alias added: GHSA-mf5h-qhm4-74qx
References
More WatchGuard Fireware vulnerabilities
- TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
- TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
- TI-2013-05132 Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote… CVSS 2.0HIGH 9.3
- TI-2026-02885 WatchGuard Firebox Out of Bounds Write Vulnerability CVSS 4.0HIGH 8.6
Sources
- CVE-2025-13937 · CVE Program
- CVE-2025-13937 · NVD
- FIRST EPSS
- GHSA-mf5h-qhm4-74qx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences