CVE-2025-4804#

WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration

Medium 4.8 CVSS v4.0 › Published 2025-05-16Updated 2026-08-08

Summary #

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.

Product status #

Product	Affected	Not affected
Fireware OS
Default	>= 12.0, < 12.11.2	>= 12.11.2
T15/T35	>= 12.5, < 12.5.13	>= 12.5.13

Weakness Type and Impact #

CWECWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPECCAPEC-592Stored XSS

Exploitation Status #

WatchGuard is not aware of any exploitation of this vulnerability in the wild.

Solution #

Fireware OS 12.11.2, Fireware OS 12.5.13

References #

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00006

Credits #

Simone Paganessi (https://www.linkedin.com/in/simonepaganessi) finder