XSS in Watchguard Fireware OS

CVE-2025-4804

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (37.1th percentile) — read the EPSS interpretation.

Affected products

Watchguard Fireware Os — versions 12.5, 12.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory)
5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory)