CVE-2025-12196: WatchGuard Fireware OS out-of-bounds write in CLI ping command

CVE-2025-12196 · Severity: high · CVSS 7.2 · Published 2025-12-04

WatchGuard Fireware OS is the operating system running on WatchGuard Firebox appliances, which serve as network firewalls and security gateways protecting corporate networks. An authenticated privileged user can exploit an out-of-bounds write vulnerability in the management CLI's ping command by sending a specially crafted command, allowing them to execute arbitrary code on the firewall and potentially compromise network security or gain full control of the appliance.

Technologies: Watchguard Fireware OS. Vendors: Watchguard.

Quick answers

Is CVE-2025-12196 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-12196 being exploited in the wild.
How severe is CVE-2025-12196?
High severity, with a CVSS score of 7.2, published 4 December 2025.
Which products and versions are affected?
Watchguard Fireware OS Default: >= 12.0, < 12.11.5; T15/T35: >= 12.0, < 12.5.14.
Is there a fix for CVE-2025-12196?
A patch was published on 2025-12-04: Fireware OS 12.11.5 and 12.5.14 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12196 attacked?
It is attacked with local access.
Am I affected by CVE-2025-12196?
Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an out-of-bounds write vulnerability (CWE-787) affecting the CLI ping command handler in WatchGuard Fireware OS. The vulnerability requires an authenticated privileged user with CLI access to exploit; it cannot be triggered remotely by unauthenticated users. An attacker with administrative privileges can craft a malicious CLI command that triggers a buffer overflow, allowing arbitrary code execution with the privileges of the CLI process. Patches are available: Fireware OS 12.11.5 for default platforms and 12.5.14 for T15/T35 appliances. WatchGuard reports no known exploitation in the wild.

Affected products

  • WatchGuard Fireware OS Default: >= 12.0, < 12.11.5; T15/T35: >= 12.0, < 12.5.14

Timeline

  • 2025-12-04: disclosed
  • 2025-12-04: patched: Fireware OS 12.11.5 and 12.5.14 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.