CVE-2025-12195
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-10
Assigner: WatchGuard Technologies, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| watchguard | fireware | From 2025.1 (inc) to 2025.1.3 (exc) |
| watchguard | firebox_t115-w | * |
| watchguard | firebox_t125 | * |
| watchguard | firebox_t125-w | * |
| watchguard | firebox_t145 | * |
| watchguard | firebox_t145-w | * |
| watchguard | firebox_t185 | * |
| watchguard | fireware | From 11.0 (inc) to 12.11.5 (exc) |
| watchguard | firebox_m270 | * |
| watchguard | firebox_m290 | * |
| watchguard | firebox_m370 | * |
| watchguard | firebox_m390 | * |
| watchguard | firebox_m440 | * |
| watchguard | firebox_m4600 | * |
| watchguard | firebox_m470 | * |
| watchguard | firebox_m4800 | * |
| watchguard | firebox_m5600 | * |
| watchguard | firebox_m570 | * |
| watchguard | firebox_m5800 | * |
| watchguard | firebox_m590 | * |
| watchguard | firebox_m670 | * |
| watchguard | firebox_m690 | * |
| watchguard | firebox_nv5 | * |
| watchguard | firebox_t20 | * |
| watchguard | firebox_t25 | * |
| watchguard | firebox_t40 | * |
| watchguard | firebox_t45 | * |
| watchguard | firebox_t55 | * |
| watchguard | firebox_t70 | * |
| watchguard | firebox_t80 | * |
| watchguard | firebox_t85 | * |
| watchguard | fireboxcloud | * |
| watchguard | fireboxv | * |
| watchguard | fireware | From 11.0 (inc) to 12.5.14 (exc) |
| watchguard | firebox_t15 | * |
| watchguard | firebox_t35 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Out-of-bounds Write in the WatchGuard Fireware OS command-line interface (CLI). It allows an authenticated privileged user to execute arbitrary code by using specially crafted IPSec configuration CLI commands. This means that someone with high-level access to the system could exploit this flaw to run unauthorized code on the device.
How can this vulnerability impact me? :
The vulnerability could allow an authenticated privileged user to execute arbitrary code on the affected WatchGuard Fireware OS devices. This could lead to unauthorized control over the device, potentially compromising network security, disrupting services, or allowing further attacks within the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your WatchGuard Fireware OS to a fixed version. The issue is resolved in Fireware OS versions 2025.1.3, 12.11.5, and 12.5.14 for T15 and T35 models. There is no workaround available, so applying the update is the immediate step to protect your systems. [1]