CVE-2025-13938#

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration

Medium 4.8 CVSS v4.0 › Published 2025-12-04Updated 2026-08-10

Summary #

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.

Product status #

Product	Affected	Not affected
Fireware OS
All platforms	12.0	—
Default	2025.1, >= 12.0, < 12.11.5	>= 12.11.5

Weakness Type and Impact #

CWECWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPECCAPEC-592Stored XSS

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 2025.1.3, Fireware OS 12.11.5, Fireware OS 12.5.14

References #

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00023

Credits #

https://www.linkedin.com/in/simonepaganessifinder