CVE-2025-12195: WatchGuard Fireware OS CLI RCE Vulnerability

CVE-2025-12195 Overview

CVE-2025-12195 is an out-of-bounds write vulnerability [CWE-787] in the command-line interface (CLI) of WatchGuard Fireware OS. An authenticated privileged user can execute arbitrary code by issuing specially crafted IPSec configuration CLI commands. The flaw affects a broad range of Firebox appliances, including the T-series, M-series, NV5, FireboxV, and FireboxCloud.

Affected releases include Fireware OS 11.0 through 11.12.4+541730, 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2. The vulnerability is tracked under WatchGuard advisory WGSA-2025-00019.

Critical Impact
An authenticated administrator can corrupt memory through crafted IPSec CLI input and execute arbitrary code on the Firebox, compromising the confidentiality, integrity, and availability of the firewall.

Affected Products

WatchGuard Fireware OS 11.0 through 11.12.4+541730
WatchGuard Fireware OS 12.0 through 12.11.4, and 12.5 through 12.5.13
WatchGuard Fireware OS 2025.1 through 2025.1.2 running on Firebox T-series, M-series, NV5, FireboxV, and FireboxCloud appliances

Discovery Timeline

2025-12-04 - CVE-2025-12195 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12195

Vulnerability Analysis

The vulnerability resides in the Fireware OS CLI handler responsible for parsing IPSec configuration commands. When a privileged user submits specially crafted input, the CLI writes data past the boundary of an allocated buffer. This out-of-bounds write corrupts adjacent memory structures on the device.

Exploitation requires authenticated access with high privileges, but the attack vector is network-reachable through the management interface. A successful write primitive against control structures or function pointers allows an attacker to redirect execution and run arbitrary code in the context of the CLI process.

Because Fireware OS runs on perimeter security appliances, code execution on the firewall undermines the trust boundary the device is intended to enforce. An attacker who chains credential theft with this flaw can pivot from administrative access to persistent control of the appliance.

Root Cause

The defect is an out-of-bounds write [CWE-787] caused by insufficient bounds validation on operand values supplied to IPSec configuration subcommands. The CLI parser accepts input lengths or indices that exceed the destination buffer, allowing memory beyond the buffer to be overwritten with attacker-controlled bytes.

Attack Vector

An attacker authenticates to the Fireware CLI with privileged credentials over the network. The attacker then issues IPSec configuration commands whose parameters are crafted to overflow the parser's internal buffer. The resulting memory corruption is leveraged to hijack control flow and execute arbitrary code on the Firebox.

No public proof-of-concept code or exploit module has been published. Refer to the WatchGuard Security Advisory WGSA-2025-00019 for vendor technical details.

Detection Methods for CVE-2025-12195

Indicators of Compromise

Unexpected privileged CLI sessions originating from unusual source IP addresses or outside normal administrative windows.
Fireware OS process crashes, restarts, or core dumps correlated with IPSec configuration activity.
Unauthorized modifications to IPSec policies, tunnels, or peer configurations on Firebox appliances.

Detection Strategies

Audit Fireware logs for IPSec CLI commands containing abnormally long arguments or non-standard characters.
Correlate administrative authentication events with subsequent configuration changes to detect compromised privileged accounts.
Compare running Fireware OS versions against the fixed releases listed in advisory WGSA-2025-00019 to identify unpatched appliances.

Monitoring Recommendations

Forward Firebox syslog and audit data to a centralized SIEM for retention and correlation across appliances.
Alert on any CLI session that issues IPSec configuration commands from accounts that do not normally administer VPN policy.
Monitor management plane access and restrict CLI exposure to dedicated administrative networks only.

How to Mitigate CVE-2025-12195

Immediate Actions Required

Upgrade Fireware OS to a fixed release as listed in WatchGuard advisory WGSA-2025-00019.
Restrict management and CLI access to trusted administrative networks and jump hosts.
Rotate Firebox administrative credentials and enforce multi-factor authentication on privileged accounts.
Review audit logs for unauthorized IPSec configuration changes since the affected versions were deployed.

Patch Information

WatchGuard has published advisory WGSA-2025-00019 listing fixed Fireware OS builds for the 11.x, 12.x, 12.5.x, and 2025.1.x branches. Administrators should apply the vendor-supplied update corresponding to their Firebox model and current release train. Consult the WatchGuard Security Advisory for the exact patched version mapping.

Workarounds

Limit accounts with privileged CLI access to the minimum required set of administrators.
Disable or block remote management access from untrusted networks until patches are applied.
Require administrative access through a bastion host with full session logging to constrain and record CLI activity.

bash

# Configuration example: restrict management access to a trusted subnet
# Replace 198.51.100.0/24 with your administrative network
policy management-access from 198.51.100.0/24 allow
policy management-access from any deny