PT-2025-37770 · Watchguard · Watchguard Fireware+1

Published 2025-09-15 · Updated 2025-09-16 · CVE-2025-6947

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.11.2

Description A Stored Cross-site Scripting (XSS) issue exists within the SIP Proxy module of WatchGuard Fireware OS. Exploitation requires an authenticated administrator session to a locally managed Firebox. This allows for improper neutralization of input during web page generation.

Recommendations Update to a version later than 12.11.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-6947

Affected Products

Firebox

Watchguard Fireware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-6947 · Security Note
• https://watchguard.com/wgrd-psirt/advisory/wgsa-2025-00012 · Note
• https://twitter.com/drak3hft7/status/1967906990480560246 · Twitter Post
• https://twitter.com/CVEnew/status/1967819570720231516 · Twitter Post