Riskcovery

CVE-2025-1239

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List

State
Published
Severity
4.8 Medium
Published
Feb 14, 2025
Updated
Aug 8, 2026
Reserved
Feb 11, 2025

Read the record on cve.org

Description

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

Scores

CVSSScoreVectorSource
4.04.8 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NWatchGuard

Weaknesses

Affected Products

ProductVersions
Fireware OSWatchGuard
  • 12.0 to before 12.11.1Affected
Fireware OSWatchGuard
  • 12.0 to before 12.5.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.