The flaw is an XPath injection in WatchGuard Fireware OS’s SSH authentication path. A remote, unauthenticated attacker who can reach the device’s management SSH interface can submit a crafted request that causes the backend to evaluate XPath expressions containing the attacker’s input. This allows the attacker to retrieve sensitive configuration details that are normally protected, exposing confidential data. The weakness stems from insufficient input validation and inadequate neutralisation of XPath expressions (CWE‑20, CWE‑208, CWE‑643).

WatchGuard Fireware OS devices are impacted. While the vendor has not listed specific vulnerable minor versions, the published patches—Fireware OS 12.5.22, 2026.4, and 12.12.4—address the flaw, implying earlier releases in those lineages are vulnerable.

The CVSS score of 8.7 classifies this vulnerability as high‑severity and the lack of an EPSS score indicates limited publicly available exploitation data, yet the possibility of exploitation remains because the management SSH service is often exposed to the network. The flaw is not currently listed in CISA’s KEV catalog, but the remote unauthenticated nature of the attack vector means that the risk to any device directly reachable via SSH is significant. Once the payload is delivered, the attacker can read configuration secrets that could be leveraged for credential theft or further lateral movement.