DeutschShown in its original language — a full translation is planned for a future version.
WatchGuard Firebox: Mehrere Schwachstellen
view advisory published 2026-07-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WatchGuard Firebox ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service zu verursachen, Daten zu manipulieren oder offenzulegen, sowie um Cross Site Scripting Angriffe durchzuführen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-8247US | high8.8 | — | ||
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code.
This vulnerabi… | ||||
| CVE-2026-13728US | medium4.4OT elevated | — | ||
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources.
This vulnerabilit… | ||||
| CVE-2026-13722US | high7.2 | — | ||
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerab… | ||||
| CVE-2026-13384US | high7.2 | — | ||
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted reques… | ||||
| CVE-2026-13383US | high7.2 | — | ||
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted reque… | ||||
| CVE-2026-13377US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnera… | ||||
| CVE-2026-13376US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulne… | ||||
| CVE-2026-13375US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows… | ||||
| CVE-2026-13374US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allo… | ||||
| CVE-2026-13373US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows… | ||||
| CVE-2026-13371US | medium4.9 | — | ||
An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which perf… | ||||
| CVE-2026-13368US | high8.1 | — | ||
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attac… | ||||
| CVE-2026-13084US | high7.5 | — | ||
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially cr… | ||||
| CVE-2026-13079US | high7.8 | — | ||
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on t… | ||||
| CVE-2026-13054US | high7.2 | — | ||
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. | ||||
| CVE-2026-13053US | high7.2 | — | ||
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command. | ||||
| CVE-2026-13050US | high7.2 | — | ||
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted reque… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-2193 - CSAF Versionself
- WID-SEC-2026-2193 - Portal Versionself
- WatchGuard Security Advisory vom 2026-07-02external
- WatchGuard Security Advisory vom 2026-07-02external
- WatchGuard Security Advisory vom 2026-07-02external
- WatchGuard Security Advisory vom 2026-07-02external
- WatchGuard Security Advisory vom 2026-07-02external
- WatchGuard Security Advisory vom 2026-07-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan