CVE-2022-25290: WatchGuard Fireware

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.

Affected products

• WatchGuard Fireware: from 12.0.0, before 12.1.3 (fixed in 12.1.3); from 12.2.0, before 12.5.9 (fixed in 12.5.9); from 12.7.0, before 12.7.2 (fixed in 12.7.2); version 12.1.3 only; version 12.5.9 only; version 12.7.2 only

Published 2022-02-24. Last modified 2026-06-17.