PT-2025-45340 · Watchguard · Watchguard Firebox

Published 2025-11-06 · Updated 2025-11-13 · CVE-2025-59396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WatchGuard Firebox versions through 2025-09-10

Description The default configuration of WatchGuard Firebox devices allows administrative access via SSH on port 4118 using the default 'readwrite' password for the 'admin' account. This allows unauthenticated access to the system. The issue has been reported as allowing unauthenticated remote command execution.

Recommendations WatchGuard Firebox versions through 2025-09-10 should have the default 'readwrite' password for the 'admin' account changed immediately. Restrict SSH access to the affected devices.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-59396

Affected Products

Watchguard Firebox

References · 12

• 🔥 https://github.com/cyberbyte000/CVE-2025-59396/blob/main/CVE-2025-59396.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59396 · Security Note
• https://twitter.com/dailytechonx/status/1988638540628971588 · Twitter Post
• https://reddit.com/r/WatchGuard/comments/1othjuq/cve202559396_is_the_anything · Reddit Post
• https://watchguard.com/wgrd-products/firewalls · Note
• https://twitter.com/leak_ix/status/1988633309757190413 · Twitter Post
• https://t.me/pentestingnews/70770 · Telegram Post
• https://twitter.com/fridaysecurity/status/1988042396991660360 · Twitter Post
• https://twitter.com/dailytechonx/status/1989002075405996294 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1988249134499852370 · Twitter Post
• https://leakix.net/search?q=%2Bplugin%3AWatchGuardFireboxPlugin&scope=leak · Reddit Post
• https://t.me/CVEtracker/36691 · Telegram Post