WatchGuard Fireware OS Host Header Injection Vulnerability

A vulnerability allowing improper input validation has been identified in WatchGuard Fireware OS versions 12.0 through 12.11. This vulnerability enables an attacker with network access to manipulate the HTTP Host header in requests to the Web UI. Exploitation could lead to redirecting users to malicious websites, poisoning the web cache, or injecting harmful JavaScript into responses from the Web UI.

Impact

Exploitation of this vulnerability could result in host header injection, allowing for redirection to malicious sites, web cache poisoning, or the injection of malicious scripts into web UI responses.

Remediation

Users can upgrade to WatchGuard Fireware OS 12.11.1 to address this vulnerability.