Description
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Published: 2026-09-29
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw lies in how the BOVPN (Bridged Over VPN) of WatchGuard Fireware OS processes configuration data received over TLS. A malformed configuration file can trigger arbitrary code execution on the host, allowing a remote attacker to run commands with root privileges. The weakness is a classic code injection issue (CWE-94) compounded by insecure handling of server certificates (CWE-295) and an escalation of privileges that enables privileged execution (CWE-829).

Affected Systems

The vulnerability affects all versions of WatchGuard Fireware OS prior to the listed fixes. Products are the Fireware OS firmware for Firebox appliances. The official remedy is the delivery of patch updates Fireware OS 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21, which correct the configuration parsing and certificate validation logic.

Risk and Exploitability

The CVSS score of 9.2 indicates a high‑severity condition that could be exploited without user interaction if the device connects to a malicious BOVPN server under the attacker’s control. The EPSS score is unavailable, and the vulnerability is not currently listed in CISA KEV, but the remote code execution potential warrants immediate attention. An attacker with control of a rogue VPN server could induce the Firebox to execute arbitrary shell commands as root, compromising device security, confidentiality, integrity, and availability.

Generated by OpenCVE AI on September 30, 2026 at 08:03 UTC.

Remediation

Vendor Solution

Fireware OS 2026.3.2, Fireware OS 2026.2.3, Fireware OS 12.12.3, Fireware OS 12.5.21

OpenCVE Recommended Actions

  • Upgrade the Fireware OS firmware to one of the patched releases: 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21, which contain the configuration parsing fix.
  • Restrict BOVPN connections to known, trusted VPN servers and verify TLS certificates on both sides to prevent exploitation via forged certificate chains.
  • Enable logging and audit BOVPN connections for anomalous traffic patterns, and investigate any unexplained command execution events.

Generated by OpenCVE AI on September 30, 2026 at 08:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard fireware
CPEs cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
Vendors & Products Watchguard fireware
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 01 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.
Title Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-295
CWE-829
CWE-94
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Fireware Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-10-01T17:08:46.734Z

Reserved: 2026-09-05T02:50:33.788Z

Link: CVE-2026-86131

cve-icon Vulnrichment

Updated: 2026-09-30T15:25:34.014Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-30T00:16:36.817

Modified: 2026-10-06T20:39:54.950

Link: CVE-2026-86131

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T08:15:17Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')