CVE-2026-93857
Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.4, 12.12.4, 12.5.22
- Public exploit
- None on Exploit-DB
Summary
Fireware OS, the operating system used on WatchGuard Firebox firewall appliances, is affected. An unauthenticated remote attacker who sends a specially crafted SIP request through a policy using the SIP proxy could run arbitrary code on the device, giving them control over the firewall.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.
Affected versions
- WatchGuard Fireware OS
From 2025.1 · fixed in 2026.4; From 12.0 · fixed in 12.12.4
- WatchGuard Fireware OS
From 12.0 · fixed in 12.5.22