A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

Project Subscriptions

Vendors Products
Watchguard Subscribe
Firebox M270 Subscribe
Firebox M290 Subscribe
Firebox M295 Subscribe
Firebox M370 Subscribe
Firebox M390 Subscribe
Firebox M395 Subscribe
Firebox M440 Subscribe
Firebox M4600 Subscribe
Firebox M470 Subscribe
Firebox M4800 Subscribe
Firebox M495 Subscribe
Firebox M5600 Subscribe
Firebox M570 Subscribe
Firebox M5800 Subscribe
Firebox M590 Subscribe
Firebox M595 Subscribe
Firebox M670 Subscribe
Firebox M690 Subscribe
Firebox M695 Subscribe
Firebox Nv5 Subscribe
Firebox T115-w Subscribe
Firebox T125 Subscribe
Firebox T125-w Subscribe
Firebox T145 Subscribe
Firebox T145-w Subscribe
Firebox T15 Subscribe
Firebox T185 Subscribe
Firebox T20 Subscribe
Firebox T25 Subscribe
Firebox T35 Subscribe
Firebox T40 Subscribe
Firebox T45 Subscribe
Firebox T55 Subscribe
Firebox T70 Subscribe
Firebox T80 Subscribe
Firebox T85 Subscribe
Fireboxcloud Subscribe
Fireboxv Subscribe
Fireware Subscribe
Fireware Os Subscribe
Advisories

No advisories yet.

Fixes

Solution

Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.5.19


Workaround

No workaround given by the vendor.

History

Mon, 10 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2. A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
References

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 02 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
Title WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-22
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:11.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.0
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:12.5
cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:2025.1
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-08-10T19:20:59.909Z

Reserved: 2026-06-23T17:55:06.157Z

Link: CVE-2026-13054

cve-icon Vulnrichment

Updated: 2026-07-06T15:45:40.439Z

cve-icon NVD

Status : Modified

Published: 2026-07-03T00:16:50.497

Modified: 2026-08-10T20:17:25.830

Link: CVE-2026-13054

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:15:05Z

Weaknesses