An attacker can exploit a cross‑site request forgery flaw in the WatchGuard Fireware OS Web UI. The flaw allows a remote user to trick an authenticated administrator into visiting a crafted web page, causing the Fireware Web UI to crash or become unavailable. The vulnerability is a traditional CSRF weakness (CWE‑352) that results in a denial‑of‑service condition for the web interface, impacting availability and potentially disrupting management functions.

Directly impacted devices are WatchGuard Fireware OS appliances running versions 11.8 through 11.12.4+541730, 12.0 through 12.11.8, and 2025.1 through 2026.1.2. This includes all Firebox models provisioned with the affected firmware releases.

With a CVSS base score of 7.1 the vulnerability is considered moderate to high risk. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting that widespread, automated exploitation may not yet be occurring. The attack requires an attacker to lure a legitimate administrator to a malicious page; no elevation or arbitrary code execution is involved, but the resulting denial of service can impair administrative access and delay critical updates.