Is CVE-2025-6946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-6946 being exploited in the wild.

How severe is CVE-2025-6946?

Medium severity, with a CVSS score of 4.8, published 4 December 2025.

Which products and versions are affected?

Watchguard Firebox Fireware OS Default >= 12.0, = 12.0, < 12.5.13.

Is there a fix for CVE-2025-6946?

A patch was published on 2025-12-04: Fireware OS 12.11.3 (Default) and 12.5.13 (T15/T35) released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-6946 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-6946?

Check whether you run Watchguard Firebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6946: WatchGuard Firebox stored XSS in IPS configuration

Q: Is there a fix for CVE-2025-6946?

A patch was published on 2025-12-04: Fireware OS 12.11.3 (Default) and 12.5.13 (T15/T35) released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-6946 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-6946?

Check whether you run Watchguard Firebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6946 · Severity: medium · CVSS 4.8 · Published 2025-12-04

WatchGuard Firebox is a network security appliance used to protect corporate networks. The management interface contains a stored cross-site scripting vulnerability in the IPS configuration section that allows authenticated administrators to inject malicious code, which then executes when other administrators access the interface, potentially leading to credential theft or further system compromise.

Technologies: Watchguard Firebox. Vendors: Watchguard.

Quick answers

Is CVE-2025-6946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-6946 being exploited in the wild.
How severe is CVE-2025-6946?: Medium severity, with a CVSS score of 4.8, published 4 December 2025.
Which products and versions are affected?: Watchguard Firebox Fireware OS Default >= 12.0, < 12.11.3; Fireware OS T15/T35 >= 12.0, < 12.5.13.
Is there a fix for CVE-2025-6946?: A patch was published on 2025-12-04: Fireware OS 12.11.3 (Default) and 12.5.13 (T15/T35) released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6946 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-6946?: Check whether you run Watchguard Firebox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability (CWE-79) exists in the IPS configuration component of the WatchGuard Firebox management interface due to improper input sanitization. An authenticated remote attacker with administrator privileges can inject arbitrary JavaScript code via IPS configuration fields; this payload is stored and executed in the browsers of other management users when they view the configuration. The vulnerability requires valid administrator credentials and authenticated access to the management interface. An attacker can execute arbitrary JavaScript in the context of the management interface, potentially capturing session tokens or performing unauthorized administrative actions. Patches are available: Fireware OS 12.11.3 for Default appliances and 12.5.13 for T15/T35 models.

Affected products

WatchGuard Firebox Fireware OS Default >= 12.0, < 12.11.3; Fireware OS T15/T35 >= 12.0, < 12.5.13

Timeline

2025-12-04: disclosed
2025-12-04: patched: Fireware OS 12.11.3 (Default) and 12.5.13 (T15/T35) released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.