An external control of file path flaw in a WatchGuard Fireware OS diagnostic command allows a remote, authenticated attacker with at least Device Monitor read‑only privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges. The vulnerability limits written content to numeric values, but tampering with critical configuration or kernel parameter files can lead to persistent root‑level changes or corrupted system operation. While the CVE does not confirm direct remote code execution, the ability to alter executable or configuration files can effectively provide an attacker with ongoing system dominance.

All WatchGuard Fireware OS devices running firmware versions prior to the published fixes – Fireware OS 2026.4, 12.12.4, and 12.5.22 – are affected. The vulnerability applies to the Fireware OS product line from Watchguard, specifically the firewall management platform exposed through the management CLI.

The flaw carries a CVSS score of 7.2, indicating moderate to high severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote authenticated access to the management CLI with at least Device Monitor privileges. The attacker can alter kernel parameters or overwrite arbitrary files, creating opportunities for persistent privilege escalation or disruption of network services when the affected files are later processed by the system.