This reflected cross‑site scripting flaw permits an attacker to inject malicious JavaScript into a crafted link that, when clicked by an authenticated management user, runs in the user’s browser. The weakness, identified as CWE‑79, allows code execution in the context of the privileged user interface, potentially exposing sensitive configuration data or enabling further attacks.

The flaw affects WatchGuard Fireware OS versions 12.7 through 12.11.7 and 2025.1 through 2026.1.1 on a wide range of Firebox devices, including the M270, M290, M295, M370, M390, M395, M440, M4600, M470, M4800, M495, M5600, M570, M5800, M590, M595, M670, M690, M695, NV5, T115‑W, T125‑W, T125, T145‑W, T145, T185, T20, T25, T40, T45, T55, T70, T80, T85, Fireboxcloud, and Fireboxv.

With a CVSS score of 5.1 and an EPSS value below 1%, the vulnerability presents moderate severity but a low estimated likelihood of exploitation. The flaw requires the attacker to craft a link and persuade a legitimate management user to click it, implying reliance on social engineering or insider assistance. Because it is not listed in CISA’s KEV catalog, there have been no confirmed large‑scale exploitations to date.