CVE-2025-13939#

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Gateway Wireless Controller

Medium 4.8 CVSS v4.0 › Published 2025-12-04Updated 2026-08-10

Summary #

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.

Product status #

Product	Affected	Not affected
Fireware OS
Default	>= 2025.1, < 2025.1.3, >= 12.0, < 12.11.5, >= 11.7.2, <= 11.12.4+541730	>= 2025.1.3, >= 12.11.5, > 11.12.4+541730
T15/T35	>= 12.0, < 12.5.14	>= 12.5.14

Weakness Type and Impact #

CWECWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPECCAPEC-592Stored XSS

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 2025.1.3, Fireware OS 12.11.5, Fireware OS 12.5.14

References #

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00024

Credits #

https://www.linkedin.com/in/simonepaganessifinder