Cross-Site Scripting Vulnerability in WatchGuard Fireware OS SIP Proxy Module
CVE-2026-13377

4.8MEDIUM

Key Information:

Vendor

Watchguard

Status
Fireware Os
Vendor
CVE Published:
2 July 2026

What is CVE-2026-13377?

The WatchGuard Fireware OS SIP Proxy module features a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user inputs during web page generation. This can lead to stored XSS attacks, allowing unauthorized execution of scripts in user contexts, compromising security further. Additionally, it serves as an unmitigated attack vector related to an existing vulnerability, emphasizing the importance of addressing this issue. Users of Fireware OS versions 12.0 through 12.12, 12.5 through 12.5.18, and 2025.1 to 2026.2 should take immediate steps to mitigate this vulnerability.

Affected Version(s)

Fireware OS 12.0 <= 12.12

Fireware OS 12.5 <= 12.5.18

Fireware OS 2025.1 <= 2026.2

References

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-...
vendor-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simone Paganessi (https://www.linkedin.com/in/simonepaganessi)
.