WatchGuard Fireware OS Vulnerable to Arbitrary File Creation via Directory Traversal
A directory traversal vulnerability in WatchGuard Fireware OS allows authenticated remote attackers to create arbitrary files, potentially overwriting system files or planting malicious ones.
A critical vulnerability has been identified in WatchGuard's Fireware OS, allowing authenticated remote attackers to create arbitrary files on affected systems. The flaw, tracked as ZDI-26-501 and related to CVE-2026-13054, carries a CVSS score of 7.2, indicating a significant security risk.
The vulnerability resides within the sigd service, specifically in how it handles signature package archives. The core issue stems from inadequate validation of user-supplied path information before it is used in file operations. This oversight enables an attacker, who has already gained authenticated access to the system, to manipulate file paths and write files to unintended locations.
Exploitation of this directory traversal flaw could have severe consequences. Attackers might leverage it to overwrite critical system files, thereby disrupting device functionality or causing denial-of-service conditions. Alternatively, they could plant malicious files, such as backdoors or configuration files, which could then be used in conjunction with other vulnerabilities to achieve code execution in the context of the samld user.
WatchGuard has acknowledged the vulnerability and has released security updates to address it. The company's Product Security Incident Response Team (PSIRT) issued an advisory, WGSA-2026-00028, detailing the affected versions and the available patches. Users are strongly advised to apply these updates promptly to mitigate the risk.
The vulnerability was initially reported to the vendor on May 22, 2026, by Nicholas Zubrisky of TrendAI Research. Following a coordinated disclosure process, the advisory was publicly released on July 29, 2026, with an update to the advisory also published on the same day. This timeline highlights the collaborative effort between researchers and vendors to address security threats.
While the vulnerability requires authentication, the ability for an attacker to create arbitrary files on a network device's operating system is a serious concern. It could serve as a stepping stone for more advanced attacks, potentially leading to full system compromise. The specific impact depends on the attacker's ability to combine this file creation capability with other weaknesses or misconfigurations within the Fireware OS environment.
This incident underscores the ongoing importance of securing network infrastructure devices, which often serve as critical gateways and control points. Regular patching and diligent security hygiene are essential to protect against such threats, especially when authenticated access can be gained by an adversary.