CVE-2026-90464: Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 2026.4 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.12.4 - Upgrade
Upgrade
WatchGuard Fireware OSto a version that resolves this vulnerability.Fixed in 12.5.22
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be remote, authenticated, have at least read-only Device Monitor privileges, and be able to access the management CLI. Unauthenticated users are not described as able to exploit it.
What level of access does successful exploitation provide?
The vulnerable diagnostic command can be used to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges. The content that can be written is limited to numeric values.
Are default deployments affected?
The available information does not state whether the affected diagnostic command, management CLI access, or Device Monitor privileges are enabled or available in a default configuration.
How can I determine whether my device is exposed?
Review whether the device runs WatchGuard Fireware OS and whether remote users with Device Monitor or higher privileges can access the management CLI and its diagnostic commands. The supplied information does not identify affected versions or a specific command name.