WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
WatchGuard believes the sophisticated threat actor Sandworm is exploiting this vulnerability in the wild. Please see our Cyclops Blink FAQ for additional information.
Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Fireware OS 12.7.2_U1, 12.5.7_U3, 12.1.3_U3
This vulnerability requires network access to management (WSM or the WebUI) on affected devices. Firebox and XTM administrators should follow recommended best practices and restrict management access to trusted networks only.