CVE-2025-13939
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A stored XSS vulnerability in the Gateway Wireless Controller module of WatchGuard Fireware OS allows injection of malicious scripts that execute in the administrator's browser.
Risk Assessment
An attacker could hijack an administrator session, alter wireless controller configuration, or steal credentials.
Recommendation
Update Fireware OS to a patched version and restrict access to the Gateway Wireless Controller module.
Other vulnerabilities in Fireware OS
See all- CVE-2026-86105High
An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource they are authorized to access.
- CVE-2026-81851Medium
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
- CVE-2026-3343Medium
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS