← Database

CVE-2025-1071

MEDIUM CVSS: 4.8 Published: 2025-02-14 Modified: 2026-08-08

Description

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.

Affected Platforms

Watchguard Firebox M290Watchguard Firebox T20Watchguard Firebox M690Watchguard Firebox T25Watchguard Firebox T80Watchguard FirewareWatchguard Firebox T55Watchguard Firebox M390Watchguard Firebox M470Watchguard Firebox M4600

Weakness Type

CWE-79

References