CVE-2025-1071

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.5.12+701324 WatchGuard Fireware OS versions 12.6 through 12.11

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS via the spamBlocker module. The vulnerability requires an authenticated administrator session to a locally managed Firebox.

Recommendations For versions 12.0 through 12.5.12+701324, update to a version outside of this range to mitigate the risk. For versions 12.6 through 12.11, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider disabling the spamBlocker module until a patch is available.