A link following flaw in the WatchGuard Fireware OS firewall daemon allows a local attacker who already has low‑privileged code execution to override any file on the system with root privileges, including critical firewall configuration files used for IP set data. The vulnerability is a classic path traversal condition that also permits creation of crafted filesystem objects and manipulation of the daemon’s update routine. The impact is direct and destructive: compromised files can redirect traffic, disable security controls or create backdoors, all without needing external network access.

WatchGuard Fireware OS installations are affected, specifically versions running prior to the patched releases Fireware OS 2026.4, 12.12.4, and 12.5.22. Any deployment using older firmware that has not been updated to these positions is at risk.

The CVSS score of 7.1 classifies the issue as high severity, and while the EPSS score is currently unavailable, the lack of remote activation and requirement for local code execution make the vector narrower but still dangerous for anyone with local access. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits yet. However, local attackers with the necessary privilege to invoke arbitrary code can trigger the flaw through the firewall’s list‑update mechanism, following the standard system file access path and hence potentially writing system‑wide configuration files.