CVE-2025-4106

High

Description

An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.

SeverityHigh

CVSS8.9

Exploit probability—

ProductFireware OS

PublishedOct 24, 2025

First seenOct 24, 2025

Weakness typeCWE-489CWE-489

How to fix

Update

WatchGuard Fireware OS12.11.3, 12.5.13 or later

Vendor advisories

psirt.watchguard.com/CVE-2025-4106
watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010

Affected products

Product	Affected versions	Fixed in
WatchGuard Fireware OS	12.0 ≤ v < 12.11.3, 12.0 ≤ v < 12.5.13	12.11.3, 12.5.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.