CVE-2026-13377 - Vulnerability Details

- WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.

Published: 2026-07-02

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Improper Neutralization of Input During Web Page Generation (CWE‑79) in the WatchGuard Fireware OS SIP Proxy module creates a stored Cross‑Site Scripting flaw. This flaw permits malicious actors to persist arbitrary script content in the SIP Proxy configuration, which is then executed when a user views the configuration via the web interface. Additionally, the issue constitutes an unmitigated attack path in relation to CVE‑2025‑6947.

Affected Systems

WatchGuard Fireware OS versions 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 through 2026.2 are affected.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of <1% suggests a very low probability of exploitation. The flaw allows injection of persistent scripts into the SIP Proxy configuration; the likely attack vector is the web‑based configuration interface, though the required privileges are not explicitly stated. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WatchGuard

Fireware OS

unaffected

Version	Status	Constraints
`2025.1`	affected	< 2026.2.1
`12.0`	affected	< 12.12.1

WatchGuard

Fireware OS

unaffected

Version	Status	Constraints
`12.0`	affected	< 12.5.19

Configuration 1 [-]

AND

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:watchguard:firebox_m270:-:::::::*
	cpe:2.3:h:watchguard:firebox_m290:-:::::::*
	cpe:2.3:h:watchguard:firebox_m370:-:::::::*
	cpe:2.3:h:watchguard:firebox_m390:-:::::::*
	cpe:2.3:h:watchguard:firebox_m440:-:::::::*
	cpe:2.3:h:watchguard:firebox_m4600:-:::::::*
	cpe:2.3:h:watchguard:firebox_m470:-:::::::*
	cpe:2.3:h:watchguard:firebox_m4800:-:::::::*
	cpe:2.3:h:watchguard:firebox_m5600:-:::::::*
	cpe:2.3:h:watchguard:firebox_m570:-:::::::*
	cpe:2.3:h:watchguard:firebox_m5800:-:::::::*
	cpe:2.3:h:watchguard:firebox_m590:-:::::::*
	cpe:2.3:h:watchguard:firebox_m670:-:::::::*
	cpe:2.3:h:watchguard:firebox_m690:-:::::::*
	cpe:2.3:h:watchguard:firebox_nv5:-:::::::*
	cpe:2.3:h:watchguard:firebox_t20:-:::::::*
	cpe:2.3:h:watchguard:firebox_t25:-:::::::*
	cpe:2.3:h:watchguard:firebox_t40:-:::::::*
	cpe:2.3:h:watchguard:firebox_t45:-:::::::*
	cpe:2.3:h:watchguard:firebox_t55:-:::::::*
	cpe:2.3:h:watchguard:firebox_t70:-:::::::*
	cpe:2.3:h:watchguard:firebox_t80:-:::::::*
	cpe:2.3:h:watchguard:firebox_t85:-:::::::*
	cpe:2.3:h:watchguard:fireboxcloud:-:::::::*
	cpe:2.3:h:watchguard:fireboxv:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:watchguard:firebox_m295:-:::::::*
	cpe:2.3:h:watchguard:firebox_m395:-:::::::*
	cpe:2.3:h:watchguard:firebox_m495:-:::::::*
	cpe:2.3:h:watchguard:firebox_m595:-:::::::*
	cpe:2.3:h:watchguard:firebox_m695:-:::::::*
	cpe:2.3:h:watchguard:firebox_t115-w:-:::::::*
	cpe:2.3:h:watchguard:firebox_t125:-:::::::*
	cpe:2.3:h:watchguard:firebox_t125-w:-:::::::*
	cpe:2.3:h:watchguard:firebox_t145:-:::::::*
	cpe:2.3:h:watchguard:firebox_t145-w:-:::::::*
	cpe:2.3:h:watchguard:firebox_t185:-:::::::*

Configuration 3 [-]

AND

cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:watchguard:firebox_t15:-:::::::*
	cpe:2.3:h:watchguard:firebox_t35:-:::::::*

No data.

Vendor Product Confidence Versions

Watchguard

Fireware Os

95%

Version	Status	Scheme	Platform
`[12.0,12.12]`	affected	semver	—
`[12.5,12.5.18]`	affected	semver	—
`[2025.1,2026.2]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Fireware OS 2026.2.1, Fireware OS 12.12.1, Fireware OS 12.5.19

OpenCVE Recommended Actions

Apply the latest WatchGuard Fireware OS firmware update that contains the fix for the stored XSS flaw in the SIP Proxy module
Restrict access to the SIP Proxy configuration web interface to trusted privileged users and enforce strict role‑based access controls
If a patch cannot be applied immediately, monitor configuration changes for unexpected script content and apply input validation or sanitization to neutralize script characters in configuration pages

Generated by OpenCVE AI on August 10, 2026 at 22:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00169.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://psirt.watchguard.com/CVE-2026-13377
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00019

History

Mon, 10 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.
CPEs	cpe:2.3:a:watchguard:fireware_os::::::::12.0 cpe:2.3:a:watchguard:fireware_os::::::::12.5 cpe:2.3:a:watchguard:fireware_os:::::::*:2025.1	cpe:2.3:a:watchguard:fireware_os::::::::
References		https://psirt.watchguard.com/CVE-2026-13377

Mon, 06 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 02 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
Title		WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration
First Time appeared		Watchguard Watchguard fireware Os
Weaknesses		CWE-79
CPEs		cpe:2.3:a:watchguard:fireware_os::::::::12.0 cpe:2.3:a:watchguard:fireware_os::::::::12.5 cpe:2.3:a:watchguard:fireware_os:::::::*:2025.1
Vendors & Products		Watchguard Watchguard fireware Os
References		https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00019
Metrics		cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

Subscriptions

Watchguard Firebox M270 Firebox M290 Firebox M295 Firebox M370 Firebox M390 Firebox M395 Firebox M440 Firebox M4600 Firebox M470 Firebox M4800 Firebox M495 Firebox M5600 Firebox M570 Firebox M5800 Firebox M590 Firebox M595 Firebox M670 Firebox M690 Firebox M695 Firebox Nv5 Firebox T115-w Firebox T125 Firebox T125-w Firebox T145 Firebox T145-w Firebox T15 Firebox T185 Firebox T20 Firebox T25 Firebox T35 Firebox T40 Firebox T45 Firebox T55 Firebox T70 Firebox T80 Firebox T85 Fireboxcloud Fireboxv Fireware Fireware Os

MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2026-07-02T23:05:32.445Z

Updated: 2026-08-10T17:20:52.993Z

Reserved: 2026-06-25T20:34:54.862Z

Link: CVE-2026-13377

Vulnrichment

Updated: 2026-07-06T15:02:55.650Z

NVD

Status : Modified

Published: 2026-07-03T00:16:51.643

Modified: 2026-08-10T18:17:40.443

Link: CVE-2026-13377

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-10T22:30:06Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object