CVE-2025-0178: WatchGuard Fireware OS XSS Vulnerability

CVE-2025-0178 Overview

CVE-2025-0178 is an improper input validation vulnerability [CWE-20] in WatchGuard Fireware OS that allows an attacker to manipulate the HTTP Host header in requests sent to the Firebox Web UI. Successful exploitation lets an attacker redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses returned by the Web UI. The issue affects Fireware OS versions 12.0 through 12.11 running on the full Firebox appliance line, including physical, virtual, and cloud form factors. WatchGuard published a security advisory addressing the flaw.

Critical Impact
An unauthenticated network attacker who convinces an administrator to interact with a crafted link can achieve script injection, open redirection, or web cache poisoning against the Firebox management interface.

Affected Products

WatchGuard Fireware OS versions 12.0 through 12.11
WatchGuard Firebox M-Series appliances (M270, M290, M370, M390, M440, M470, M570, M590, M670, M690, M4600, M4800, M5600, M5800, NV5)
WatchGuard Firebox T-Series appliances (T15, T20, T25, T35, T40, T45, T55, T70, T80, T85), FireboxV, and FireboxCloud

Discovery Timeline

2025-02-14 - CVE-2025-0178 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0178

Vulnerability Analysis

The Firebox Web UI does not properly validate or sanitize the value of the HTTP Host header supplied in inbound requests. Because the Web UI trusts this header when constructing responses, an attacker can supply a crafted value that alters the response context. Depending on how the header is reused, the attacker can trigger three distinct outcomes: redirection of an authenticated administrator to an attacker-controlled domain, insertion of poisoned entries into an intermediate web cache, or reflection of attacker-controlled content that renders as executable JavaScript in the administrator's browser.

Exploitation requires user interaction, typically an administrator clicking a crafted link that targets the Web UI. The scope of impact extends beyond confidentiality to integrity of the management session, since injected JavaScript executes in the context of the Firebox management interface.

Root Cause

The root cause is improper input validation of the Host header before it is used to build absolute URLs, redirect targets, or reflected content in Web UI responses. Fireware OS treats the client-supplied header as trusted input rather than validating it against an allowlist of configured hostnames for the appliance.

Attack Vector

The attack vector is network-based and does not require prior authentication, but does require user interaction. An attacker sends or lures an administrator into issuing an HTTP request to the Firebox Web UI with a manipulated Host header. The manipulated header propagates into generated links, redirect responses, or reflected page content, enabling client-side attacks against the administrator session.

See the WatchGuard Security Advisory WGSA-2025-00003 for vendor-supplied technical details.

Detection Methods for CVE-2025-0178

Indicators of Compromise

Inbound HTTP or HTTPS requests to the Firebox Web UI containing a Host header value that does not match the appliance's configured management hostname or IP address.
Redirect responses from the Firebox pointing administrators to unfamiliar external domains.
Unexpected JavaScript content or third-party script references appearing in Web UI response bodies.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the Firebox management interface with anomalous or spoofed Host header values.
Alert on administrator sessions that originate a Web UI request and then follow a redirect to an external domain within the same session.
Compare captured Web UI response bodies against known baselines to identify reflected content or unexpected inline scripts.

Monitoring Recommendations

Enable verbose HTTP request logging on any device fronting the Firebox management interface and forward logs to a central analytics platform.
Restrict Web UI access to a dedicated management network and monitor for any authentication or configuration change events sourced from outside that segment.
Track browser telemetry from administrator workstations for unexpected navigation events initiated from the Firebox management interface.

How to Mitigate CVE-2025-0178

Immediate Actions Required

Upgrade Fireware OS to a fixed release as specified in the WatchGuard Security Advisory.
Restrict access to the Firebox Web UI to trusted management networks only, and disable exposure to untrusted or internet-facing interfaces.
Require administrators to access the Web UI from hardened workstations that block navigation to untrusted external links.

Patch Information

WatchGuard has published advisory WGSA-2025-00003 covering CVE-2025-0178. Administrators should review the advisory for the specific fixed Fireware OS version and apply the update to all affected Firebox appliances, including physical, virtual (FireboxV), and cloud (FireboxCloud) deployments running versions 12.0 through 12.11.

Workarounds

Limit Web UI reachability using Firebox policy rules so only specific management IP addresses can initiate connections to the interface.
Instruct administrators to type the Firebox management URL directly into the browser and avoid clicking Web UI links received via email, chat, or external referrals.
Front the Web UI with a reverse proxy that enforces a strict allowlist of expected Host header values and rejects requests carrying any other value.

bash

# Example reverse proxy Host header allowlist (nginx)
server {
    listen 443 ssl;
    server_name firebox.example.com;

    if ($host !~* ^(firebox\.example\.com)$) {
        return 400;
    }

    location / {
        proxy_set_header Host firebox.example.com;
        proxy_pass https://firebox-internal:8080;
    }
}