Description
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
Published: 2026-10-27
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: Remote code execution
Action: Immediate patch
AI Analysis

Impact

Fireware OS contains a stack‑based buffer overflow in its SIP proxy component. When an attacker sends a specially crafted SIP request through a policy that routes traffic to the SIP proxy, the input is processed before authentication, causing an overflow of the function stack. The vulnerability falls under relative buffer overflow weaknesses (CWE‑120 and CWE‑121) and results in arbitrary code execution on the device.

Affected Systems

WatchGuard Fireware OS is affected. All releases older than the patched versions – Fireware OS 12.12.4, Fireware OS 12.5.22, and Fireware OS 2026.4 – are vulnerable. Network appliances running those legacy builds that expose the SIP proxy interface are at risk.

Risk and Exploitability

The CVSS score of 9.2 indicates critical severity. Exploit confidence (EPSS) is currently unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet, but the remote, unauthenticated attack surface via SIP makes it attractive to threat actors. An attacker could leverage the overflow to gain shell access or remote code execution without credentials, potentially leading to full system compromise.

Generated by OpenCVE AI on October 27, 2026 at 17:54 UTC.

Remediation

Vendor Solution

Fireware OS 2026.4, Fireware OS 12.12.4, Fireware OS 12.5.22

OpenCVE Recommended Actions

  • Apply the Fireware OS 12.12.4, 12.5.22, or 2026.4 update to eliminate the vulnerable stack buffer overflow.
  • If an immediate patch cannot be applied, disable or restrict the SIP proxy service and block SIP traffic on the affected firewall until the update is deployed.
  • Continuously monitor firewall logs for suspicious SIP traffic patterns and verify that no unauthorized SIP requests are being processed.

Generated by OpenCVE AI on October 27, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
Title Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
First Time appeared Watchguard
Watchguard fireware Os
Weaknesses CWE-120
CWE-121
CWE-787
CPEs cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
Vendors & Products Watchguard
Watchguard fireware Os
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Watchguard Fireware Os
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published:

Updated: 2026-10-27T15:52:27.970Z

Reserved: 2026-09-18T19:09:36.067Z

Link: CVE-2026-93857

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T16:17:32.463

Modified: 2026-10-27T16:17:32.463

Link: CVE-2026-93857

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T18:30:07Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-121

    Stack-based Buffer Overflow

  • CWE-787

    Out-of-bounds Write