Watchguard Firebox M295
25 CVEs affecting Watchguard Firebox M295. Latest disclosed: 2026-07-03. Critical: 2, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14733 | Critical | 9.8 | 2025-12-19 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2025-9242 | Critical | 9.8 | 2025-09-17 | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vul… |
CVE-2026-8247 | High | 8.8 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary cod… |
CVE-2026-13368 | High | 8.1 | 2026-07-03 | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote… |
CVE-2026-13079 | High | 7.8 | 2026-07-03 | A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT… |
CVE-2026-13084 | High | 7.5 | 2026-07-03 | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by… |
CVE-2026-13722 | High | 7.2 | 2026-07-03 | WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can… |
CVE-2026-13384 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a spe… |
CVE-2026-13383 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-13054 | High | 7.2 | 2026-07-03 | A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Fireb… |
CVE-2026-13053 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially cra… |
CVE-2026-13050 | High | 7.2 | 2026-07-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a sp… |
CVE-2026-3987 | High | 7.2 | 2026-04-01 | A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a privileged authenticated remote attacker to execute arbitrar… |
CVE-2026-3342 | High | 7.2 | 2026-03-03 | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissi… |
CVE-2026-4266 | Medium | 6.7 | 2026-03-30 | An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another v… |
CVE-2026-4315 | Medium | 6.5 | 2026-03-30 | A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condit… |
CVE-2026-3343 | Medium | 6.1 | 2026-03-03 | A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated man… |
CVE-2026-13371 | Medium | 4.9 | 2026-07-03 | An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data… |
CVE-2026-3344 | Medium | 4.9 | 2026-03-03 | A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and maintain limited persistence via a mal… |
CVE-2026-13377 | Medium | 4.8 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Sto… |