NexaPulse
Subscribe
4.8mediumMedium

CVE-2026-13377

Watchguard Fireware

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.

Exploitation status

  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, no special conditions are needed to exploit it.
  • To exploit it, an administrative account is needed.
  • Beyond that, someone has to be persuaded to take an action first.

Scoring

CVSS
4.8 (v3.1)
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4
4.8
Weakness
CWE-79
Assigned by
5d1c2695-1a31-4499-88ae-e847036fd7e3

Dates

Published
2026-07-03
Last modified
2026-08-28
Sources
NVD

Affected products

  • Watchguard Fireware12.0 - 12.12.1, 2025.1 - 2026.2.1, 12.5 - 12.5.18
  • Watchguard Firebox M270all versions
  • Watchguard Firebox M290all versions
  • Watchguard Firebox M370all versions
  • Watchguard Firebox M390all versions
  • Watchguard Firebox M440all versions
  • Watchguard Firebox M4600all versions
  • Watchguard Firebox M470all versions
  • Watchguard Firebox M4800all versions
  • Watchguard Firebox M5600all versions
  • Watchguard Firebox M570all versions
  • Watchguard Firebox M5800all versions

As listed in the NVD configuration data. Not a statement about your estate.

References