Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.

Related CPE's

o

watchguard

fireware

3

h

watchguard

firebox_m270

-

h

watchguard

firebox_m290

-

h

watchguard

firebox_m370

-

h

watchguard

firebox_m390

-

h

watchguard

firebox_m440

-

h

watchguard

firebox_m4600

-

h

watchguard

firebox_m470

-

h

watchguard

firebox_m4800

-

h

watchguard

firebox_m5600

-

h

watchguard

firebox_m570

-

h

watchguard

firebox_m5800

-

h

watchguard

firebox_m590

-

h

watchguard

firebox_m670

-

h

watchguard

firebox_m690

-

h

watchguard

firebox_nv5

-

h

watchguard

firebox_t20

-

h

watchguard

firebox_t25

-

h

watchguard

firebox_t40

-

h

watchguard

firebox_t45

-

h

watchguard

firebox_t55

-

h

watchguard

firebox_t70

-

h

watchguard

firebox_t80

-

h

watchguard

firebox_t85

-

h

watchguard

fireboxcloud

-

h

watchguard

fireboxv

-

h

watchguard

firebox_m295

-

h

watchguard

firebox_m395

-

h

watchguard

firebox_m495

-

h

watchguard

firebox_m595

-

h

watchguard

firebox_m695

-

h

watchguard

firebox_t115-w

-

h

watchguard

firebox_t125

-

h

watchguard

firebox_t125-w

-

h

watchguard

firebox_t145

-

h

watchguard

firebox_t145-w

-

h

watchguard

firebox_t185

-

h

watchguard

firebox_t15

-

h

watchguard

firebox_t35

-

References

https://psirt.watchguard.com/CVE-2026-13377

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00019

Vendor Advisory

Weaknesses

5d1c2695-1a31-4499-88ae-e847036fd7e3

Secondary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.8 · Medium

Information

Source identifier

5d1c2695-1a31-4499-88ae-e847036fd7e3

Vulnerability status

Modified

Published

2026-07-03T00:16:51.643Z

3 months ago

Last modified

2026-08-28T00:16:47.600Z

1 month ago