WatchGuard Firebox XPath Injection Vulnerability Allowing Unauthorized Information Retrieval

A vulnerability allowing XPath injection has been identified in WatchGuard Fireware OS. This issue may enable a remote, unauthenticated attacker to access sensitive information from the Firebox configuration via an exposed authentication or management web interface. The vulnerability affects Firebox systems with at least one authentication hotspot configured and is present in Fireware OS versions 11.11 through 11.12.4+541730, 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive configuration information on the affected Firebox system.

Remediation

Users can upgrade to Fireware OS 2025.1.3, 12.11.5, or 12.5.14 (for T15 & T35 models) to address this vulnerability. For Fireware OS 11.x, the vulnerability is no longer supported as this version has reached its end of life.