CVE-2025-1239

Vulnerability

Overview A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances due to improper neutralization of input in the Blocked Sites list [1]. This flaw allows an authenticated remote attacker with administrator privileges to inject arbitrary JavaScript code that is stored and later executed in the context of another management user's session.

Exploitation

Prerequisites Exploitation requires an authenticated administrator session to a locally managed Firebox. The attacker must have administrative access to the device and then craft a malicious entry in the Blocked Sites list. When another administrator views the list, the injected script executes in their browser within the management interface [1].

Impact

Successful exploitation enables arbitrary JavaScript execution in the Firebox management interface. This could lead to session hijacking, unauthorized actions, or further compromise of the management session. The CVSS v4.0 score is 5.1 (Medium), with low impact on confidentiality and integrity of the management interface [1].

Mitigation

WatchGuard has released patches: Fireware OS 12.11.1 for all affected 12.x versions, and Fireware OS 12.5.13 for T15 and T35 models. No workaround is available; upgrading to the fixed versions is recommended [1].