CVE-2025-4106: WatchGuard Firebox leftover debug code vulnerability

Published Oct 24, 2025

Updated

An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.

Affected Software

1 affected component

WatchGuard Firebox

Event History

Oct 24, 2025

CVE Published

via MITRE·09:32 PM

Data Sourced

via MITRE·09:32 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-4106?

CVE-2025-4106 has a critical severity level due to the potential for administrative exploitation.

How do I fix CVE-2025-4106?

To remediate CVE-2025-4106, upgrade WatchGuard Fireware OS to version 12.11.3 or later.

What versions of Fireware OS are affected by CVE-2025-4106?

CVE-2025-4106 affects WatchGuard Fireware OS versions from 12.0 to 12.11.2.

Who can exploit CVE-2025-4106?

Only authenticated admin users with access to both the management WebUI and command line interface can exploit CVE-2025-4106.

What impact does CVE-2025-4106 have on Firebox devices?

CVE-2025-4106 allows an authenticated admin to enable a diagnostic debug shell, potentially compromising the device's security.