CVE-2025-1545: WatchGuard Fireware Information Disclosure

CVE-2025-1545 Overview

An XPath Injection vulnerability exists in WatchGuard Fireware OS that may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability specifically impacts Firebox systems that have at least one authentication hotspot configured, enabling attackers to manipulate XPath queries to extract confidential configuration data without requiring any authentication credentials.

Critical Impact

Unauthenticated remote attackers can extract sensitive firewall configuration data including credentials, network topology, and security policies from vulnerable WatchGuard Firebox appliances with authentication hotspots enabled.

Affected Products

• WatchGuard Fireware OS 11.11 up to and including 11.12.4+541730
• WatchGuard Fireware OS 12.0 up to and including 12.11.4
• WatchGuard Fireware OS 12.5 up to and including 12.5.13
• WatchGuard Fireware OS 2025.1 up to and including 2025.1.2
• WatchGuard Firebox T-Series (T15, T20, T25, T35, T40, T45, T55, T70, T80, T85, T115-W, T125, T125-W, T145, T145-W, T185)
• WatchGuard Firebox M-Series (M270, M290, M370, M390, M440, M470, M570, M590, M670, M690, M4600, M4800, M5600, M5800)
• WatchGuard FireboxCloud, FireboxV, and Firebox NV5

Discovery Timeline

• 2025-12-04 - CVE-2025-1545 published to NVD
• 2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-1545

Vulnerability Analysis

This vulnerability is classified as an XPath Injection (CWE-91), which occurs when user-supplied input is incorporated into XPath queries without proper sanitization. In the context of WatchGuard Fireware OS, the authentication and management web interfaces process user input that is subsequently used to construct XPath expressions for querying XML-based configuration data.

The vulnerability is exploitable remotely over the network without requiring authentication, making it particularly dangerous for internet-facing management interfaces. However, exploitation requires that the target Firebox system has at least one authentication hotspot configured, which serves as a prerequisite condition for the vulnerable code path to be reached.

When successfully exploited, an attacker can manipulate XPath queries to traverse the XML document structure and extract sensitive information that would normally be protected. This could include administrative credentials, VPN configurations, firewall rules, network topology information, and other security-critical settings stored in the Firebox configuration.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-controllable data before it is incorporated into XPath query expressions. The authentication hotspot functionality in Fireware OS processes input from the web interface that gets concatenated directly into XPath queries without proper escaping or parameterization.

XPath Injection vulnerabilities occur when applications build XPath expressions dynamically using string concatenation with untrusted input. Without proper validation, attackers can inject malicious XPath syntax that modifies the query logic, allowing them to bypass authentication checks or extract unauthorized data from the underlying XML data store.

Attack Vector

The attack vector for CVE-2025-1545 is network-based, targeting the exposed authentication or management web interfaces of WatchGuard Firebox appliances. An attacker would craft malicious HTTP requests containing XPath injection payloads designed to manipulate the query logic.

A typical XPath injection attack against this vulnerability would involve injecting special characters and XPath operators (such as ', or, and, //, *, etc.) into input fields processed by the hotspot authentication mechanism. By carefully constructing these payloads, an attacker can alter the intended query to return data from different parts of the XML configuration document, effectively bypassing access controls and extracting sensitive information.

The attack does not require any authentication, and the attacker only needs network access to the vulnerable web interface. Organizations that expose their Firebox management interfaces to the internet are at significantly higher risk.

Detection Methods for CVE-2025-1545

Indicators of Compromise

• Unusual or malformed HTTP requests to the authentication hotspot endpoints containing XPath special characters (', ", [, ], //, *, or, and)
• Multiple rapid authentication attempts or configuration queries from a single source IP
• Access logs showing requests with encoded XPath operators or injection patterns targeting the management web interface
• Unexpected data extraction patterns or increased outbound data from the Firebox appliance

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect and block XPath injection patterns in HTTP requests
• Monitor authentication hotspot logs for anomalous query patterns or syntax errors that may indicate injection attempts
• Implement network traffic analysis to identify suspicious requests targeting Firebox management interfaces
• Configure SIEM correlation rules to alert on multiple failed or unusual authentication attempts

Monitoring Recommendations

• Enable verbose logging on WatchGuard Firebox authentication and management interfaces
• Implement real-time alerting for requests containing known XPath injection payload signatures
• Monitor for configuration access patterns that deviate from normal administrative behavior
• Review access logs regularly for reconnaissance activity targeting hotspot authentication endpoints

How to Mitigate CVE-2025-1545

Immediate Actions Required

• Update WatchGuard Fireware OS to a patched version immediately following guidance from the WatchGuard Security Advisory
• Restrict access to Firebox management and authentication web interfaces to trusted networks only using firewall rules
• Disable authentication hotspots temporarily if they are not essential until patching can be completed
• Audit current Firebox configurations for any signs of unauthorized access or data exfiltration

Patch Information

WatchGuard has released security patches addressing this vulnerability. Administrators should consult the WatchGuard Security Advisory WGSA-2025-00025 for specific patched versions and upgrade instructions. The following Fireware OS versions are affected and should be upgraded:

• Fireware OS 11.11 through 11.12.4+541730
• Fireware OS 12.0 through 12.11.4
• Fireware OS 12.5 through 12.5.13
• Fireware OS 2025.1 through 2025.1.2

Workarounds

• Restrict management interface access to internal networks or VPN-only access, preventing external exploitation
• Implement IP allowlisting for administrative access to the Firebox web interfaces
• If authentication hotspots are not required for business operations, disable them until patches are applied
• Deploy a reverse proxy with input validation in front of exposed management interfaces as an additional layer of protection

# Example: Restrict management access to internal subnet only
# Configure in WatchGuard System Manager or via CLI
# Deny external access to management interfaces
# Allow only trusted internal IP ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

# Verify hotspot configuration status
show hotspot status

# Review current access policies for management interface
show policy management-access