CVE-2025-4804

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.11.1

Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS) via the spamBlocker module. This issue requires an authenticated administrator session to a locally managed Firebox. Stored XSS occurs when a malicious script is permanently stored on the target server and later executed in the browser of another user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the spamBlocker module to minimize the risk of exploitation.