An LDAP Injection flaw in WatchGuard Fireware OS allows a remote unauthenticated attacker to retrieve sensitive data from a connected LDAP authentication server via the exposed authentication or management web interface. The injection can also be leveraged to authenticate as an LDAP user with a partial identifier if the attacker already possesses that user’s passphrase. This vulnerability is rooted in improper input validation in LDAP queries, exposing confidentiality and potentially authorizing malicious access.

The affected system is WatchGuard Fireware OS. Vulnerable releases include versions 12.0 through 12.11.6, 12.5 through 12.5.15, and 2025.1 through 2026.0.

The CVSS base score is 7, indicating high severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is still low. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a remote attacker sending crafted LDAP search strings via the unauthorized web interface, gaining access to sensitive entries or authenticating as a user. No authentication is required to trigger the injection, increasing the potential impact on organizations that expose these interfaces publicly.