Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.4, 12.12.4, 12.5.22
- Public exploit
- None on Exploit-DB
Summary
The Fireware OS software used on WatchGuard firewalls is affected, specifically its Active Directory authentication service. An attacker who can control or intercept traffic to the configured Active Directory server could crash the service or potentially run arbitrary code on the device by sending a specially crafted response, without needing to authenticate first.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.
Affected versions
- WatchGuard Fireware OS
From 2025.1 · fixed in 2026.4; From 12.0 · fixed in 12.12.4
- WatchGuard Fireware OS
From 12.0 · fixed in 12.5.22