UpHeron
All vulnerabilities

Servers and applications

CVE-2025-6946

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management ninterface of another management user.

Severity
Medium 4.8
Published
4 Dec 2025
Last changed
25 Sept 2026
Added to UpHeron
3 Nov 2026
Fixed in
12.5.13, 12.11.3
Sources
NVD

Affected software

SoftwareAffected versions
WatchGuard Fireware OSServers and applications · cpe:o:watchguard:fireware
  • From 12.0.0 before 12.11.3
  • From 12.5 before 12.5.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-6946
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-6946