CVE-2017-14615

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware versions prior to 12.0

Description A security issue was discovered in the XML-RPC interface of WatchGuard Fireware. When a failed login attempt is made to the login endpoint, if JavaScript code is embedded as the value of the user element, the code will be rendered in the context of any logged-in user visiting the "Traffic Monitor" sections "Events" and "All" in the Web UI. This results in no further events being visible in the Traffic Monitor until the device is restarted.

Recommendations For versions prior to 12.0, update to version 12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Traffic Monitor" sections until the update is applied.