Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

WatchGuard Firebox XPath Injection Vulnerability in Web CGI (WatchGuard Fireware OS)

CVE-2025-1545
HIGH 8.2

At a glance

Source
NVD
EPSS
EPSS 0.48 % · percentile 42 ()
State
PUBLISHED
Published
Updated
Assigner
WatchGuard
NVD status
Modified

Search on…

Description

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 4.0HIGH 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NWatchGuard
CVSS 4.0HIGH 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · 5d1c2695-1a31-4499-88ae-e847036fd7e3 (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
WatchGuard · Fireware OSaffected 2025.1 < 2025.1.3 ; affected 12.0 < 12.11.5 ; affected 11.11 ≤ 11.12.4+541730
WatchGuard · Fireware OSaffected 12.0 < 12.5.14

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD