CVE-2026-3343
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
Risk Assessment
An attacker could steal sessions, modify configuration, or perform other actions with administrator privileges.
Recommendation
Update Fireware OS to a patched version and educate users about the risks of clicking suspicious links.
Other vulnerabilities in Fireware OS
See all- CVE-2026-81851Medium
A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially crafted configuration.
- CVE-2025-13939Medium
A stored XSS vulnerability in the Gateway Wireless Controller module of WatchGuard Fireware OS allows injection of malicious scripts that execute in the administrator's browser.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.