WatchGuard Fireware OS Stored Cross-Site Scripting Vulnerability in SIP Proxy Module

A stored cross-site scripting vulnerability has been identified in WatchGuard Fireware OS versions 12.0 through 12.11.2. This issue resides within the SIP Proxy module and requires an authenticated administrator session on a locally managed Firebox. The vulnerability allows an attacker with administrator privileges to inject and execute arbitrary JavaScript in the management interface, potentially affecting other users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the Firebox management interface.

Remediation

Users can upgrade to Fireware OS 12.11.3 to address this vulnerability.