TI-2026-56207 Aliases CVE-2026-81433 GHSA-h8f9-rp2r-962g

Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

LOW 39CWE-120Published 2026-09-29 · Updated 2026-10-01

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00204 10th percentileScored 2026-11-07

Fix Fixed Fireware OS (WatchGuard): 2026.3.2, 2026.2.3, 12.12.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WatchGuard	Fireware OS	2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3	2026.3.2, 2026.2.3, 12.12.3	Patch available	CNA

Fireware OS VendorWatchGuard Affected 2026.3 to before 2026.3.2; 2025.0 to before 2026.2.3; 12.0 to before 12.12.3 Fixed in 2026.3.2, 2026.2.3, 12.12.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:watchguard:fireware::::::::	—	—	WatchGuard

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* Versions — — ·WatchGuard

Remediation

Fix · CNA Fireware OS (WatchGuard) Fixed in 2026.3.2, 2026.2.3, 12.12.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-29
WatchGuard Fireware OS 12.12.3, 2026.2.3, 2026.3.2
14 records Highest priority Priority MEDIUM 4 MEDIUM, 10 LOW
Other records, highest priority first
- TI-2026-58925 Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code ExecutionPriority MEDIUM 48
- TI-2026-58904 Fireware OS Resource Exhaustion in Login Process Allows Denial of ServicePriority MEDIUM 44
- TI-2026-58926 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of ServicePriority MEDIUM 42
Show all 14 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-81433
2026-10-03 Alias added: GHSA-h8f9-rp2r-962g

References

Advisory 1

https://psirt.watchguard.com/CVE-2026-81433

TI-2022-09698 On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
TI-2025-13451 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2025-08474 WatchGuard Firebox iked Out of Bounds Write Vulnerability KEVCVSS 4.0CRITICAL 9.3
TI-2022-07330 WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… KEVCVSS 3.1HIGH 8.8
TI-2023-19293 A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8… CVSS 3.1MEDIUM 6.5
TI-2015-04587 Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to… CVSS 2.0MEDIUM 6.5

See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences