UpHeron
All vulnerabilities

Servers and applications

CVE-2025-1071

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

Severity
Medium 4.8
Published
14 Feb 2025
Last changed
8 Aug 2026
Added to UpHeron
3 Nov 2026
Fixed in
12.5.13, 12.11.1
Sources
NVD

Affected software

SoftwareAffected versions
WatchGuard Fireware OSServers and applications · cpe:o:watchguard:fireware
  • From 12.0.0 before 12.11.1
  • From 12.5 before 12.5.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-1071
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-1071