CVE-2025-4804: WatchGuard Fireware OS

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.

Affected products

• WatchGuard Fireware OS: from 12.0, before 12.11.2 (fixed in 12.11.2); from 12.5, before 12.5.13 (fixed in 12.5.13)

Published 2025-05-16. Last modified 2026-08-08.