CVEvulnerability

CVE-2025-1545

8.2 HIGH Published 2025-12-04 Modified 2026-09-25 Official page ↗
Status
Modified
Published
2025-12-04
Last modified
2026-09-25
Assigner
5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS 4.0 (5d1c2695-1a31-4499-88ae-e847036fd7e3)
8.2 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-91

Description

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

Affected configurations

• watchguard fireware (>= 2025.1 < 2025.1.3) • watchguard fireware (>= 11.11 < 12.11.5) • watchguard fireware (>= 11.11 < 12.5.14)

Related

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References