CVE-2025-13940
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
An Expected Behavior Violation vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand check in the Web UI will correctly show a failure message.
Risk Assessment
Bypassing the integrity check may allow the system to boot with modified components, potentially leading to security compromise and persistent malware presence.
Recommendation
Update Fireware OS to a patched version and monitor integrity check failure messages.
Other vulnerabilities in WatchGuard Fireware OS
See all- CVE-2026-19318Critical
A stack-based buffer overflow in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-19315Critical
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-19313Critical
A heap overflow vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
- CVE-2026-13086Critical
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
- CVE-2025-14733CriticalActively exploited
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. It affects both mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. Even after deleting those configurations, if a branch office VPN to a static gateway peer remains, the Firebox may still be vulnerable.
- CVE-2025-9242CriticalActively exploited
Out-of-bounds write vulnerability in the iked process of WatchGuard Fireware OS. A remote unauthenticated attacker can execute arbitrary code. Affects mobile user VPN with IKEv2 and branch office VPN using IKEv2 when configured with a dynamic gateway peer. If configurations were deleted but a branch office VPN to a static peer remains, the device may still be vulnerable.
- CVE-2026-78011High
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78010High
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78009High
An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
- CVE-2026-78008High
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.
Original NVD description (English source)
An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.