CVE-2025-1545

EUVD-2025-201297
An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.
aka Blind XPath Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.48%
Affected Products (NVD)
VendorProductVersion
watchguardfireware
2025.1 ≤
𝑥
< 2025.1.3
watchguardfireware
11.11 ≤
𝑥
< 12.11.5
watchguardfireware
11.11 ≤
𝑥
< 12.5.14
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://psirt.watchguard.com/CVE-2025-1545
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00025