PT-2025-49165 · Watchguard · Firebox+1

Exodus Intelligence · Publicado 2025-12-04 · Atualizado 2025-12-05 · CVE-2025-1545

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.11 through 11.12.4+541730 WatchGuard Fireware OS versions 12.0 through 12.11.4 WatchGuard Fireware OS versions 12.5 through 12.5.13 WatchGuard Fireware OS versions 2025.1 through 2025.1.2

Description A remote, unauthenticated attacker could potentially retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface due to an XPath Injection issue. This impacts Firebox systems with at least one authentication hotspot configured. The vulnerability involves the exploitation of XPath queries to access configuration data. The vulnerable component is the authentication or management web interface.

Recommendations WatchGuard Fireware OS version 11.11 through 11.12.4+541730 should be updated. WatchGuard Fireware OS version 12.0 through 12.11.4 should be updated. WatchGuard Fireware OS version 12.5 through 12.5.13 should be updated. WatchGuard Fireware OS version 2025.1 through 2025.1.2 should be updated.

Correção

Enumeração de Fraquezas

CWE-91

Identificadores relacionados

BDU:2025-15457

CVE-2025-1545

Produtos afetados

Firebox

Fireware Os

Referências · 7

• https://twitter.com/CVEnew/status/1996704778051629064 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1545 · Aviso do Fabricante
• https://t.me/CVEtracker/38868 · Publicação no Telegram
• https://watchguard.com/wgrd-psirt/advisory/wgsa-2025-00025 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-15457 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1996794986466070987 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-1545 · Nota de Segurança