Is CVE-2025-4106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-4106 being exploited in the wild.

How severe is CVE-2025-4106?

Informational severity, with a CVSS score of 8.9, published 24 October 2025.

Which products and versions are affected?

Watchguard Firebox Fireware OS 12.0 - 12.11.2 (Default); Fireware OS 12.0 - 12.5.12 (T15/T35).

Is there a fix for CVE-2025-4106?

A patch was published on 2025-10-24: Fireware OS 12.11.3 and 12.5.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-4106 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-4106?

Check whether you run Watchguard Firebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-4106: WatchGuard Firebox leftover debug code in diagnostic shell

CVE-2025-4106 · Severity: info · CVSS 8.9 · Published 2025-10-24

WatchGuard Firebox is a network firewall that protects corporate infrastructure. An authenticated administrator with both web and command-line access can exploit leftover diagnostic code to enable a debug shell, potentially gaining deep system access and the ability to modify firewall behavior or access sensitive configuration data.

Technologies: Watchguard Firebox. Vendors: Watchguard.

Quick answers

Is CVE-2025-4106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-4106 being exploited in the wild.
How severe is CVE-2025-4106?: Informational severity, with a CVSS score of 8.9, published 24 October 2025.
Which products and versions are affected?: Watchguard Firebox Fireware OS 12.0 - 12.11.2 (Default); Fireware OS 12.0 - 12.5.12 (T15/T35).
Is there a fix for CVE-2025-4106?: A patch was published on 2025-10-24: Fireware OS 12.11.3 and 12.5.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4106 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-4106?: Check whether you run Watchguard Firebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability involves leftover debug code (CWE-489) in WatchGuard Firebox that allows an authenticated admin user to enable a diagnostic debug shell. The attack requires the attacker to have admin credentials and access to both the management WebUI and command-line interface, and involves uploading a platform and version-specific diagnostic package followed by executing a debug command. An attacker exploiting this can gain shell access to the firewall system with admin privileges. Patches are available: Fireware OS 12.11.3 for Default platforms and 12.5.13 for T15/T35 platforms.

Affected products

WatchGuard Firebox Fireware OS 12.0 - 12.11.2 (Default); Fireware OS 12.0 - 12.5.12 (T15/T35)

Timeline

2025-10-24: disclosed
2025-10-24: patched: Fireware OS 12.11.3 and 12.5.13 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.