CVE-2025-13940: WatchGuard Fireware

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.

Affected products

• WatchGuard Fireware: from 2025.1, before 2025.1.3 (fixed in 2025.1.3); from 12.8.1, before 12.11.5 (fixed in 12.11.5)

Published 2025-12-04. Last modified 2026-09-25.