Denial-of-Service via Unsafe Deserialization in Fireware Management Web UI

Executive Summary

This vulnerability allows an authenticated administrator to cause a denial-of-service (DoS) condition in the WatchGuard Firebox Management Web UI.

It occurs because the put_data endpoint performs unsafe deserialization of attacker-supplied input, meaning that malformed or crafted data sent to this endpoint can disrupt normal operation.

The issue affects Fireware OS versions 12.0 through 12.12 and 2025.1 through 2026.2.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated administrator sending malformed or crafted data to the put_data endpoint of the Fireware Management Web UI to trigger a denial-of-service condition.

Detection would involve monitoring or testing the put_data endpoint for unsafe deserialization attempts or malformed input that could cause service disruption.

No specific detection commands or tools are provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial-of-service condition, which can make the Fireware Management Web UI unavailable or unresponsive.

Since the vulnerability requires authenticated administrator access, an attacker with such privileges can disrupt management operations, potentially affecting network security management and monitoring.

The CVSS score of 6.9 indicates a medium severity impact.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Fireware OS to a fixed version. The issue has been resolved in Fireware OS versions 2026.2.1 and 12.12.1, as well as in 12.5.x for T15 and T35 models.

No workaround is available, so applying the update is the immediate and necessary step to prevent exploitation.

Useful 0 Not Useful 0