Cross-Site Scripting Vulnerability in WatchGuard Fireware OS
CVE-2025-6947

4.8MEDIUM

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
15 September 2025

What is CVE-2025-6947?

A Cross-Site Scripting (XSS) vulnerability in WatchGuard Fireware OS enables stored XSS attacks through the SIP Proxy module. This vulnerability necessitates an authenticated administrator session on a locally managed Firebox, allowing attackers to tamper with web pages served to users. Affected systems running Fireware OS versions from 12.0 through 12.11.2 are particularly at risk, underscoring the importance of rigorous input validation and security measures to protect against such exploitation.

Affected Version(s)

Fireware OS 12.0 <= 12.11.2

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6947 : Cross-Site Scripting Vulnerability in WatchGuard Fireware OS