CVE-2025-1545: WatchGuard Firebox XPath Injection Vulnerability in Web CGI

Published Dec 4, 2025
·
Updated

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

Affected Software

37 affected components
WatchGuard Fireware OS>=11.11<=11.12.4+541730, >=12.0<=12.11.4, >=12.5<=12.5.13, >=2025.1<=2025.1.2
All of the following
WatchGuard Fireware>=2025.1<2025.1.3
Any of the following
WatchGuard Firebox T115-w
WatchGuard Firebox T125
WatchGuard Firebox T125-w
WatchGuard Firebox T145
WatchGuard Firebox T145-w
WatchGuard Firebox T185
All of the following
WatchGuard Fireware>=11.11<12.11.5
Any of the following
WatchGuard Firebox M270
WatchGuard Firebox M290
WatchGuard Firebox M370
WatchGuard Firebox M390
WatchGuard Firebox M440
WatchGuard Firebox M4600
WatchGuard Firebox M470
WatchGuard Firebox M4800
WatchGuard Firebox M5600
WatchGuard Firebox M570
WatchGuard Firebox M5800
WatchGuard Firebox M590
WatchGuard Firebox M670
WatchGuard Firebox M690
WatchGuard Firebox Nv5
WatchGuard Firebox T20
WatchGuard Firebox T25
WatchGuard Firebox T40
WatchGuard Firebox T45
WatchGuard Firebox T55
WatchGuard Firebox T70
WatchGuard Firebox T80
WatchGuard Firebox T85
WatchGuard Fireboxcloud
WatchGuard Fireboxv
All of the following
WatchGuard Fireware>=11.11<12.5.14
Any of the following
WatchGuard Firebox T15
WatchGuard Firebox T35

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.

    Fixed in 2025.1.3
  2. Upgrade

    Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.

    Fixed in 12.11.5
  3. Upgrade

    Upgrade WatchGuard Fireware OS to a version that resolves this vulnerability.

    Fixed in 12.5.14

Event History

Dec 4, 2025
CVE Published
via MITRE·09:48 PM
Data Sourced
via MITRE·09:48 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-1545?

CVE-2025-1545 is considered a high-severity vulnerability due to its potential to expose sensitive information.

2

How do I fix CVE-2025-1545?

To mitigate CVE-2025-1545, update WatchGuard Fireware OS to the latest version that addresses this vulnerability.

3

What systems are affected by CVE-2025-1545?

CVE-2025-1545 affects specific versions of WatchGuard Fireware OS, including versions from 11.11 to 2025.1.2.

4

What type of attack can exploit CVE-2025-1545?

CVE-2025-1545 can be exploited through XPath Injection, allowing unauthorized access to sensitive configuration data.

5

Who can be affected by CVE-2025-1545?

Remote unauthenticated attackers may exploit CVE-2025-1545 to access sensitive information on affected Firebox systems.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203