CVE-2025-13939
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A stored XSS vulnerability in the Gateway Wireless Controller module of WatchGuard Fireware OS allows injection of malicious scripts that execute in the administrator's browser.
Risk Assessment
An attacker could hijack an administrator session, alter wireless controller configuration, or steal credentials.
Recommendation
Update Fireware OS to a patched version and restrict access to the Gateway Wireless Controller module.
Other vulnerabilities in Fireware OS
See all- CVE-2026-81851Medium
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
- CVE-2026-3343Medium
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.