What is CVE-2025-6999?

CVE-2025-6999 is a vulnerability in Watchguard Fireware Os, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). Published 2025-09-15.

Is CVE-2025-6999 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Watchguard Fireware Os

CVE-2025-6999

An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack. WatchGuard does not believe there is a practical exploit chain with a meaningful security impact for this vulnerability.

Vulnerability class: HTTP Request Smuggling

EPSS: 0.005 (41.1th percentile) — read the EPSS interpretation.

Affected products

Watchguard Fireware Os — versions 12.0

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory)
5d1c2695-1a31-4499-88ae-e847036fd7e3 (vendor-advisory)

Frequently asked questions

What is CVE-2025-6999?: CVE-2025-6999 is a vulnerability in Watchguard Fireware Os, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). Published 2025-09-15.
Is CVE-2025-6999 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.