# CVE-2025-1545: WatchGuard Fireware XPath injection in Web CGI

Source: https://junglewise.ai/threats/cve-2025-1545-watchguard-fireware-xpath-injection-in-web-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-1545 · Severity: high · CVSS 7.5 · Published 2025-12-04

WatchGuard Firebox is a network firewall appliance used to protect corporate networks and control internet access. An XPath injection vulnerability in its web-based administration interface allows unauthenticated remote attackers to extract sensitive configuration data from systems with authentication hotspots enabled, potentially exposing credentials, network topology, and security policies.

Technologies: [Watchguard Fireware OS](https://junglewise.ai/threats/technologies/fireware-os). Vendors: [Watchguard](https://junglewise.ai/threats/vendors/watchguard).

## Quick answers

**Is CVE-2025-1545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-1545 being exploited in the wild.

**How severe is CVE-2025-1545?** High severity, with a CVSS score of 7.5, published 4 December 2025.

**Which products and versions are affected?** Watchguard Fireware OS 2025.1.x before 2025.1.3; 12.0.x through 12.11.4; 11.11.x through 11.12.4+541730; T15/T35 12.0.x before 12.5.14.

**Is there a fix for CVE-2025-1545?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-1545 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-1545?** Check whether you run Watchguard Fireware OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an XPath injection (CWE-91) in the web CGI components of WatchGuard Fireware OS. It affects systems with at least one authentication hotspot configured, allowing an unauthenticated attacker to query the Firebox configuration via the exposed management web interface. The attack requires network access to the management interface but no authentication credentials. Successful exploitation permits information disclosure of sensitive configuration data. Patches are available: Fireware OS 2025.1.3, 12.11.5, and 12.5.14 or later versions.

## Affected products

- WatchGuard Fireware OS 2025.1.x before 2025.1.3; 12.0.x through 12.11.4; 11.11.x through 11.12.4+541730; T15/T35 12.0.x before 12.5.14

## Timeline

- 2025-12-04: disclosed

## References

- [https://psirt.watchguard.com/CVE-2025-1545](https://psirt.watchguard.com/CVE-2025-1545)
- [https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00025](https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00025)

## Related threats

- [WatchGuard Fireware OS integer overflow in WebSocket Access Portal](https://junglewise.ai/threats/cve-2026-93866-an-integer-overflow-vulnerability-in-the-websocket-connection)
- [WatchGuard Fireware OS authentication bypass in FireCluster daemon](https://junglewise.ai/threats/cve-2026-93865-a-missing-authentication-vulnerability-in-the-fireware-os)
- [WatchGuard Fireware OS arbitrary file overwrite via link following](https://junglewise.ai/threats/cve-2026-93864-a-link-following-vulnerability-in-watchguard-fireware-os-s)
- [WatchGuard Fireware OS out-of-bounds read in FireCluster Sync](https://junglewise.ai/threats/cve-2026-93862-an-out-of-bounds-read-vulnerability-in-the-firecluster-sync)
- [WatchGuard Fireware OS stack buffer overflow in SIP proxy](https://junglewise.ai/threats/cve-2026-93857-a-stack-based-buffer-overflow-vulnerability-in-fireware-os-s-sip)