WatchGuard Fireware OS (versions prior to 2026.3.2, 2026.2.3, 12.12.3, and 12.5.21)
The operating system that runs WatchGuard Firebox network security appliances, which organisations use to protect their networks from unauthorised access.
Root Cause
The OS fails to sanitise input received from the remote VPN server during connection setup. Because that input is trusted and passed into system commands without validation, a malicious server can inject arbitrary commands. The appliance effectively executes whatever the remote end tells it to.
Attack Vector
An attacker positions themselves as — or compromises — the remote VPN server your Firebox connects to. During the TLS handshake, the attacker sends crafted configuration data containing embedded commands. The Firebox processes this input without checking it, and those commands run with root privileges — full administrative control of the device.
Detection Notes
Check Fireware OS system logs for unexpected command execution or configuration changes following VPN tunnel establishment. Look for outbound connections to unfamiliar IP addresses initiated by the Firebox itself. Monitor for new administrative accounts or changed credentials on the appliance.
Recommended Actions
- Update Fireware OS to version 2026.3.2, 2026.2.3, 12.12.3, or 12.5.21 immediately.
- Audit all BOVPN over TLS remote server configurations and confirm each endpoint is trusted and controlled by your organisation.
- Restrict management access to the Firebox to known, internal IP ranges only.