Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.4, 12.12.4, 12.5.22
- Public exploit
- None on Exploit-DB
Summary
Fireware OS, the operating system used on WatchGuard firewall appliances, is affected by this flaw in its logging service. An attacker positioned on the network who can impersonate or intercept traffic to the configured log server could use a specially crafted certificate to run arbitrary code with root privileges on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.
Affected versions
- WatchGuard Fireware OS
From 2025.1 · fixed in 2026.4; From 12.0 · fixed in 12.12.4
- WatchGuard Fireware OS
From 12.0 · fixed in 12.5.22