CVE-2022-31749

Authenticated arbitrary file read/write in WatchGuard Fireware OS

State: Published
Severity: 6.5 Medium
Published: Jan 27, 2025
Updated: Jan 28, 2025
Reserved: May 26, 2022

Description

An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	rapid7

Weaknesses

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

Product	Versions
Fireware OSWatchGuard	before 12.8.1Affected 12.x to before 12.1.4Affected 12.2.x to before 12.5.xAffected 12.5.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.