Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.4, 12.12.4, 12.5.22
- Public exploit
- None on Exploit-DB
Summary
Fireware OS, the operating system used on WatchGuard firewall appliances, is affected when the FireCluster feature is enabled. An unauthenticated remote attacker could send a specially crafted request to the cluster management IP and perform privileged administrative actions with root-level access on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.
Affected versions
- WatchGuard Fireware OS
From 2025.1 · fixed in 2026.4; From 12.0 · fixed in 12.12.4
- WatchGuard Fireware OS
From 12.0 · fixed in 12.5.22