An out‑of‑bounds write flaw in WatchGuard Fireware OS’s command‑line interface allows an authenticated privileged user to craft a malicious CLI command that corrupts memory and executes arbitrary code. The weakness, identified as CWE-787, can grant the attacker full control over the device, compromising confidentiality, integrity and availability.

The vulnerability affects Firebox devices running WatchGuard Fireware OS where the vulnerable CLI command handler is present. All firmware releases before the fixed versions—2026.2.1, 12.12.1 and 12.5.19—are potentially susceptible; devices that have not yet been upgraded should assume the flaw exists.

The CVSS score of 8.6 reflects high severity and the EPSS score of less than 1% indicates that exploitation is unlikely but still possible. The vulnerability is not in the CISA KEV catalog. Successful exploitation requires the attacker to authenticate with sufficient privileges to the management interface and submit the specially crafted CLI command to trigger the out‑of‑bounds write, after which code execution is achieved on the device.