Security Advisories

Heap Buffer Overflow in libwebp WebP Codec

WatchGuard — Wed, 01 Nov 2023 17:40:18 +0000

Heap Buffer Overflow in libwebp WebP Codec

Advisory ID

WGSA-2023-00008

WatchGuard Wed, 11/01/2023 - 10:40

CVE

CVE-2023-4863

Impact

Critical

Status

Not Applicable

Product Family

Firebox, Endpoint, WatchGuard Cloud, Dimension, Other Software, Secure Wi-Fi

Published Date

2023-11-01

Updated Date

2023-11-01

Workaround Available

False

Summary

On September 11th 2023, Google published an advisory describing a vulnerability in Google Chrome that could allow a remote attacker to potentially execute arbitrary code using a carefully crafted WebP image file. On September 25th, the vulnerability scope was expanded to include the libwebp library used by many applications beyond Google Chrome.

Affected

No WatchGuard products use the affected version of the libwebp library

Resolution

No resolution necessary

References

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop…

Advisory Product List

Product Family

Product Branch

Product List

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox

Firebox T (4th Gen)

NV5, T25, T45, T85

Endpoint

Panda Dome

Essential, Advanced, Complete, Premium

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard Cloud

Dimension

Other Software

WatchGuard System Manager (WSM)

WSM

Other Software

Authentication Gateway

Secure Wi-Fi

Wi-Fi 6

AP130, AP330, AP430CR, AP432

Secure Wi-Fi

Wi-Fi 4 & 5

AP322, AP420, AP125, AP225W, AP325, AP327X

WatchGuard EPDR and AD360 Local Privilege Escalation

WatchGuard — Thu, 28 Sep 2023 07:30:47 +0000

WatchGuard EPDR and AD360 Local Privilege Escalation

Advisory ID

WGSA-2023-00004

WatchGuard Thu, 09/28/2023 - 00:30

CVE

CVE-2023-26236

Impact

High

Status

Resolved

Product Family

Endpoint

Published Date

2023-09-28

Updated Date

2023-09-28

Workaround Available

False

CVSS Score

7.8

CVSS Vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

WatchGuard EPDR and Panda AD360 versions up to, and including, 8.00.22.0009 allows an adversary with local access to achieve privilege escalation by providing crafted parameters to a protection agent component.

Affected

WatchGuard EPDR and Panda AD360 versions before 8.00.22.0010

Resolution

WatchGuard EPDR and Panda AD360 version 8.00.22.0010

Credits

Marcos Díaz Castiñeiras (https://www.linkedin.com/in/mdiazcast/) and Antón Ortigueira Vázquez (https://www.linkedin.com/in/antonortigueira/) from BlackArrow (Tarlogic).

Advisory Product List

Product Family

Product Branch

Product List

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard EPDR and AD360 Advanced Protection Bypass Vulnerability via Registry Key

WatchGuard — Thu, 28 Sep 2023 07:30:47 +0000

WatchGuard EPDR and AD360 Advanced Protection Bypass Vulnerability via Registry Key

Advisory ID

WGSA-2023-00005

WatchGuard Thu, 09/28/2023 - 00:30

CVE

CVE-2023-26237

Impact

Medium

Status

Resolved

Product Family

Endpoint

Published Date

2023-09-28

Updated Date

2023-09-28

Workaround Available

True

CVSS Score

6.7

CVSS Vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

WatchGuard EPDR and Panda AD360 versions up to, and including, 8.00.22.0009 allows an adversary with local access and system privileges to bypass the Advanced Protection feature by setting a Windows registry key. A successful exploit of this vulnerability could allow an attacker to execute a binary that has not completed classification.

Affected

WatchGuard EPDR and Panda AD360 versions before 8.00.22.0010

Resolution

WatchGuard EPDR and Panda AD360 version 8.00.22.0010

Credits

Marcos Díaz Castiñeiras (https://www.linkedin.com/in/mdiazcast/) and Antón Ortigueira Vázquez (https://www.linkedin.com/in/antonortigueira/) from BlackArrow (Tarlogic).

Advisory Product List

Product Family

Product Branch

Product List

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard EPDR and AD360 Anti-Tamper Protection Bypass Vulnerability

WatchGuard — Thu, 28 Sep 2023 07:30:47 +0000

WatchGuard EPDR and AD360 Anti-Tamper Protection Bypass Vulnerability

Advisory ID

WGSA-2023-00006

WatchGuard Thu, 09/28/2023 - 00:30

CVE

CVE-2023-26238

Impact

High

Status

Resolved

Product Family

Endpoint

Published Date

2023-09-28

Updated Date

2023-09-28

Workaround Available

False

CVSS Score

7.7

CVSS Vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

WatchGuard EPDR and Panda AD360 versions up to, and including, 8.00.22.0009 allows an adversary with local access to bypass anti-tamper protection by sending crafted commands to the protection agent via IPC.

Affected

WatchGuard EPDR and Panda AD360 versions before 8.00.22.0010

Resolution

WatchGuard EPDR and Panda AD360 version 8.00.22.0010

Credits

Marcos Díaz Castiñeiras (https://www.linkedin.com/in/mdiazcast/) and Antón Ortigueira Vázquez (https://www.linkedin.com/in/antonortigueira/) from BlackArrow (Tarlogic).

Advisory Product List

Product Family

Product Branch

Product List

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard EPDR and AD360 Local Protection Management Password Exposure Vulnerability

WatchGuard — Thu, 28 Sep 2023 07:30:47 +0000

WatchGuard EPDR and AD360 Local Protection Management Password Exposure Vulnerability

Advisory ID

WGSA-2023-00007

WatchGuard Thu, 09/28/2023 - 00:30

CVE

CVE-2023-26239

Impact

Medium

Status

Resolved

Product Family

Endpoint

Published Date

2023-09-28

Updated Date

2023-09-28

Workaround Available

False

CVSS Score

5.5

CVSS Vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard EPDR and Panda AD360 versions up to, and including, 8.00.22.0009 allows an adversary with local access to recover the local protection management password by monitoring inter-process communications.

Affected

WatchGuard EPDR and Panda AD360 versions before 8.00.22.0010

Resolution

WatchGuard EPDR and Panda AD360 version 8.00.22.0010

Credits

Marcos Díaz Castiñeiras (https://www.linkedin.com/in/mdiazcast/) and Antón Ortigueira Vázquez (https://www.linkedin.com/in/antonortigueira/) from BlackArrow (Tarlogic).

Advisory Product List

Product Family

Product Branch

Product List

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

Firebox Authenticated Arbitrary File Read Vulnerability

WatchGuard — Fri, 05 May 2023 00:10:08 +0000

Firebox Authenticated Arbitrary File Read Vulnerability

Advisory ID

WGSA-2023-00002

WatchGuard Thu, 05/04/2023 - 17:10

CVE

CVE-2023-2357

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2023-05-05

Updated Date

2023-05-04

Workaround Available

True

CVSS Score

4.9

CVSS Vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker to read arbitrary text files from the filesystem via the Fireware management command line interface.

Affected

Fireware OS before 12.9.3

Resolution

Fireware OS 12.9.3

Workaround

In order to successfully exploit this vulnerability, an attacker must successfully authenticate using a management account (read-only or read-write) to the Fireware command line interface. Firebox administrators should follow the best practices described here to securely enable remote Firebox management where needed.

Credits

Reported by independent security researcher Ren9IE

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

Firebox T (4th Gen)

NV5, T25, T45, T85

Firebox

FireboxCloud

Small, Medium, Large, XLarge

OpenSSH Server 9.1 Double Free Vulnerability (CVE-2023-25136)

WatchGuard — Wed, 22 Mar 2023 19:51:03 +0000

OpenSSH Server 9.1 Double Free Vulnerability (CVE-2023-25136)

Advisory ID

WGSA-2023-00001

WatchGuard Wed, 03/22/2023 - 12:51

CVE

CVE-2023-25136

Impact

Medium

Status

Not Applicable

Product Family

Firebox, Dimension

Published Date

2023-03-22

Updated Date

2023-03-22

Workaround Available

False

CVSS Score

6.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Summary

On February 3, 2023, researchers at Qualys disclosed CVE-2023-25136, a double free vulnerability in OpenSSH Server v9.1. The exploit is non-trivial but a successful exploit could allow an unauthenticated attacker to execute arbitrary code on an unprotected system.

Affected

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSH. Note, some vulnerability scanners may incorrectly report the Firebox's OpenSSH server as vulnerable
Dimension	Not Impacted	Dimension uses a patched version of OpenSSH that is not affected by this vulnerability

Resolution

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSH. Note, some vulnerability scanners may incorrectly report the Firebox's OpenSSH server as vulnerable
Dimension	Not Impacted	Dimension uses a patched version of OpenSSH that is not affected by this vulnerability

References

https://blog.qualys.com/vulnerabilities-threat-research/2023/02/03/cve-2023-251…

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

Firebox T (4th Gen)

NV5, T25, T45, T85

Dimension

OpenSSL CVE-2022-3602 and CVE-2022-3786

WatchGuard — Tue, 01 Nov 2022 17:01:19 +0000

OpenSSL CVE-2022-3602 and CVE-2022-3786

Advisory ID

WGSA-2022-00021

WatchGuard Tue, 11/01/2022 - 10:01

CVE

CVE-2022-3602, CVE-2022-3786

Impact

High

Status

Not Applicable

Product Family

Firebox, Endpoint, WatchGuard Cloud, Dimension, Other Software, Secure Wi-Fi

Published Date

2022-11-01

Updated Date

2023-11-01

Workaround Available

True

CVSS Score

9.0

CVSS Vector

TBD

Summary

Updated 2 November 2022, 12:22 PDT: Added response for Endpoint products

On 1 November 2022, OpenSSL disclosed CVE-2022-3602 and CVE-2022-3786, two high severity buffer overflow vulnerabilities in certificate validation present in OpenSSL 3.0.x up to and including 3.0.6. An attacker could exploit either vulnerability with a maliciously-crafted certificate that has been signed by a trusted certificate authority.

Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors have led this to be downgraded to HIGH.

Affected

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSL
WSM	Not Impacted	WSM does not use a vulnerable version of OpenSSL
Dimension	Not Impacted	Dimension does not use a vulnerable version of OpenSSL
Cloud Wi-Fi APs	Not Impacted	WatchGuard APs do not use a vulnerable version of OpenSSL
Endpoint	Not Impacted	WatchGuard EPDR and Panda AD360 do not use a vulnerable version of OpenSSL

Resolution

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSL
WSM	Not Impacted	WSM does not use a vulnerable version of OpenSSL
Dimension	Not Impacted	Dimension does not use a vulnerable version of OpenSSL
Cloud Wi-Fi APs	Not Impacted	WatchGuard APs do not use a vulnerable version of OpenSSL
Endpoint	Not Impacted	WatchGuard EPDR and Panda AD360 do not use a vulnerable version of OpenSSL

References

https://www.openssl.org/news/secadv/20221101.txt

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Endpoint

Panda Dome

Essential, Advanced, Complete, Premium

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard Cloud

Dimension

Other Software

WatchGuard System Manager (WSM)

WSM

Secure Wi-Fi

Wi-Fi 6

AP130, AP330, AP430CR, AP432

Secure Wi-Fi

Wi-Fi 4 & 5

AP322, AP420, AP125, AP225W, AP325, AP327X

OpenVPN Unauthenticated Access To Control Channel Data (CVE-2020-15078)

WatchGuard — Tue, 05 Jul 2022 14:50:01 +0000

OpenVPN Unauthenticated Access To Control Channel Data (CVE-2020-15078)

Advisory ID

WGSA-2022-00020

WatchGuard Tue, 07/05/2022 - 07:50

CVE

CVE-2020-15078

Impact

High

Status

Investigating

Product Family

Firebox

Published Date

2022-07-05

Updated Date

2022-07-05

Workaround Available

True

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

A bug found in OpenVPN that may also apply to Watchguard Mobile VPN could allow a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication which can be used to potentially trigger further information leaks. Based off the limited vulnerability details we believe this vulnerability may impact Fireware OS releases after 12.5.3 and have updated the version of OpenSSL included in Fireware OS 12.8.1 out of an abundance of caution.

Affected

Fireware OS before 12.8.1 and 12.5.3 up to and including 12.5.10.

Note: Firebox Fireware OS 12.1.x and before is not vulnerable

Resolution

Resolved in Fireware OS 12.8.1 release

References

https://community.openvpn.net/openvpn/wiki/CVE-2020-15078

Advisory Product List

Product Family

Product Branch

Product List

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Limited Authenticated Arbitrary File Read/Write Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Limited Authenticated Arbitrary File Read/Write Vulnerability

Advisory ID

WGSA-2022-00019

WatchGuard Thu, 06/23/2022 - 13:50

CVE

CVE-2022-31749

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

False

CVSS Score

6.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10

Resolution

Fireware OS 12.8.1, 12.5.10, 12.1.4

Credits

Jake Baines of Rapid7

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge