Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.4, 12.12.4, 12.5.22
- Public exploit
- None on Exploit-DB
Summary
Fireware OS, the operating system used on WatchGuard Firebox firewalls, is affected when it authenticates users against an Active Directory server. An attacker who can control or intercept traffic to that server could crash the device or potentially run arbitrary code on it by sending a specially crafted response.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
Affected versions
- WatchGuard Fireware OS
From 2025.1 · fixed in 2026.4; From 12.0 · fixed in 12.12.4
- WatchGuard Fireware OS
From 12.0 · fixed in 12.5.22