The flaw is a missing authentication check in Fireware OS’s FireCluster state synchronization, which enables an unauthenticated attacker on the cluster synchronization network segment to send crafted packets that force an early termination of a BOVPN tunnel. The failure to authenticate these packets allows the attacker to disrupt VPN connectivity, resulting in a denial of service for the tunnel.

Vendors: WatchGuard. Product: Fireware OS. Affected versions are not explicitly listed in the data; the advisory only identifies the product line, so any installation of Fireware OS that includes FireCluster state sync is potentially vulnerable unless patched.

The CVSS score of six indicates moderate severity. No EPSS score is provided, suggesting insufficient public data on exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The anticipated attack vector is network-based, requiring proximity to the cluster synchronization network segment. The vulnerability can be exploited by sending crafted synchronization messages that bypass authentication, causing a denial of service to the VPN tunnel. Given the lack of widespread exploitation data, the risk remains moderate until further evidence arises.