WatchGuard Fireware OS Insecure Deserialization Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing insecure deserialization has been identified in WatchGuard Fireware OS. This issue enables an attacker with write access to the local filesystem, obtained through another vulnerability, to execute arbitrary code as the 'portald' user. The vulnerability affects Fireware OS versions 12.1 to 12.11.8 and 2025.1 to 2026.1.2. However, Firebox platforms that do not support the Access Portal feature, such as the T-15 and T-35, are not affected.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with the privileges of the 'portald' user.

Remediation

Users can upgrade to Fireware OS 2026.2 or 12.12 to address this vulnerability.