Vulnerabilities

TI-2025-00138 CVE-2025-0178 · GHSA-4h8g-6mc6-vxxj

WatchGaurd Firebox Host Header Injection Vulnerability

LOW 23

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00237 Published 2025-02-14 Fixed in 12.11.1, 12.5.13 CWE-20

TI-2025-01059 CVE-2025-1239 · GHSA-7f92-pjcc-3q4m

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List

LOW 23

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00554 Published 2025-02-14 Fixed in 12.11.1, 12.5.13 CWE-79

TI-2025-00909 CVE-2025-1071 · GHSA-j9jw-jrhw-54vc

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module

LOW 22

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00301 Published 2025-02-14 Fixed in 12.11.1, 12.5.13 CWE-79

Vulnerabilities

Filters

WatchGaurd Firebox Host Header Injection Vulnerability

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module