Security Advisories

Firebox Authenticated Arbitrary File Read Vulnerability

WatchGuard — Fri, 05 May 2023 00:10:08 +0000

Firebox Authenticated Arbitrary File Read Vulnerability

Advisory ID

WGSA-2023-00002

WatchGuard Thu, 05/04/2023 - 17:10

CVE

CVE-2023-2357

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2023-05-05

Updated Date

2023-05-04

Workaround Available

True

CVSS Score

4.9

CVSS Vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker to read arbitrary text files from the filesystem via the Fireware management command line interface.

Affected

Fireware OS before 12.9.3

Resolution

Fireware OS 12.9.3

Workaround

In order to successfully exploit this vulnerability, an attacker must successfully authenticate using a management account (read-only or read-write) to the Fireware command line interface. Firebox administrators should follow the best practices described here to securely enable remote Firebox management where needed.

Credits

Reported by independent security researcher Ren9IE

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

Firebox T (4th Gen)

NV5, T25, T45, T85

Firebox

FireboxCloud

Small, Medium, Large, XLarge

OpenSSH Server 9.1 Double Free Vulnerability (CVE-2023-25136)

WatchGuard — Wed, 22 Mar 2023 19:51:03 +0000

OpenSSH Server 9.1 Double Free Vulnerability (CVE-2023-25136)

Advisory ID

WGSA-2023-00001

WatchGuard Wed, 03/22/2023 - 12:51

CVE

CVE-2023-25136

Impact

Medium

Status

Not Applicable

Product Family

Firebox, Dimension

Published Date

2023-03-22

Updated Date

2023-03-22

Workaround Available

False

CVSS Score

6.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Summary

On February 3, 2023, researchers at Qualys disclosed CVE-2023-25136, a double free vulnerability in OpenSSH Server v9.1. The exploit is non-trivial but a successful exploit could allow an unauthenticated attacker to execute arbitrary code on an unprotected system.

Affected

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSH. Note, some vulnerability scanners may incorrectly report the Firebox's OpenSSH server as vulnerable
Dimension	Not Impacted	Dimension uses a patched version of OpenSSH that is not affected by this vulnerability

Resolution

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSH. Note, some vulnerability scanners may incorrectly report the Firebox's OpenSSH server as vulnerable
Dimension	Not Impacted	Dimension uses a patched version of OpenSSH that is not affected by this vulnerability

References

https://blog.qualys.com/vulnerabilities-threat-research/2023/02/03/cve-2023-251…

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

Firebox T (4th Gen)

NV5, T25, T45, T85

Dimension

OpenSSL CVE-2022-3602 and CVE-2022-3786

WatchGuard — Tue, 01 Nov 2022 17:01:19 +0000

OpenSSL CVE-2022-3602 and CVE-2022-3786

Advisory ID

WGSA-2022-00021

WatchGuard Tue, 11/01/2022 - 10:01

CVE

CVE-2022-3602, CVE-2022-3786

Impact

High

Status

Investigating

Product Family

Firebox, Endpoint, WatchGuard Cloud, Dimension, Other Software, Secure Wi-Fi

Published Date

2022-11-01

Updated Date

2022-11-02

Workaround Available

True

CVSS Score

9.0

CVSS Vector

TBD

Summary

Updated 2 November 2022, 12:22 PDT: Added response for Endpoint products

On 1 November 2022, OpenSSL disclosed CVE-2022-3602 and CVE-2022-3786, two high severity buffer overflow vulnerabilities in certificate validation present in OpenSSL 3.0.x up to and including 3.0.6. An attacker could exploit either vulnerability with a maliciously-crafted certificate that has been signed by a trusted certificate authority.

Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors have led this to be downgraded to HIGH.

Affected

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSL
WSM	Not Impacted	WSM does not use a vulnerable version of OpenSSL
Dimension	Not Impacted	Dimension does not use a vulnerable version of OpenSSL
Cloud Wi-Fi APs	Not Impacted	WatchGuard APs do not use a vulnerable version of OpenSSL
Endpoint	Not Impacted	WatchGuard EPDR and Panda AD360 do not use a vulnerable version of OpenSSL

Resolution

Product	Affected Version(s)	Note
Firebox	Not Impacted	The Firebox does not use a vulnerable version of OpenSSL
WSM	Not Impacted	WSM does not use a vulnerable version of OpenSSL
Dimension	Not Impacted	Dimension does not use a vulnerable version of OpenSSL
Cloud Wi-Fi APs	Not Impacted	WatchGuard APs do not use a vulnerable version of OpenSSL
Endpoint	Not Impacted	WatchGuard EPDR and Panda AD360 do not use a vulnerable version of OpenSSL

References

https://www.openssl.org/news/secadv/20221101.txt

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Endpoint

Panda Dome

Essential, Advanced, Complete, Premium

Endpoint

Panda AD360

AD360

Endpoint

WatchGuard EPDR

EPP, EDR, EPDR

WatchGuard Cloud

Dimension

Other Software

WatchGuard System Manager (WSM)

WSM

Secure Wi-Fi

Wi-Fi 6

AP130, AP330, AP430CR, AP432

Secure Wi-Fi

Wi-Fi 4 & 5

AP322, AP420, AP125, AP225W, AP325, AP327X

OpenVPN Unauthenticated Access To Control Channel Data (CVE-2020-15078)

WatchGuard — Tue, 05 Jul 2022 14:50:01 +0000

OpenVPN Unauthenticated Access To Control Channel Data (CVE-2020-15078)

Advisory ID

WGSA-2022-00020

WatchGuard Tue, 07/05/2022 - 07:50

CVE

CVE-2020-15078

Impact

High

Status

Investigating

Product Family

Firebox

Published Date

2022-07-05

Updated Date

2022-07-05

Workaround Available

True

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

A bug found in OpenVPN that may also apply to Watchguard Mobile VPN could allow a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication which can be used to potentially trigger further information leaks. Based off the limited vulnerability details we believe this vulnerability may impact Fireware OS releases after 12.5.3 and have updated the version of OpenSSL included in Fireware OS 12.8.1 out of an abundance of caution.

Affected

Fireware OS before 12.8.1 and 12.5.3 up to and including 12.5.10.

Note: Firebox Fireware OS 12.1.x and before is not vulnerable

Resolution

Resolved in Fireware OS 12.8.1 release

References

https://community.openvpn.net/openvpn/wiki/CVE-2020-15078

Advisory Product List

Product Family

Product Branch

Product List

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Limited Authenticated Arbitrary File Read/Write Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Limited Authenticated Arbitrary File Read/Write Vulnerability

Advisory ID

WGSA-2022-00019

WatchGuard Thu, 06/23/2022 - 13:50

CVE

CVE-2022-31749

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

False

CVSS Score

6.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10

Resolution

Fireware OS 12.8.1, 12.5.10, 12.1.4

Credits

Jake Baines of Rapid7

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Information Disclosure Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Information Disclosure Vulnerability

Advisory ID

WGSA-2022-00017

WatchGuard Thu, 06/23/2022 - 13:50

CVE

CVE-2022-31790

Impact

High

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

False

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10.

Resolution

Fireware OS 12.8.1, 12.5.10 and 12.1.4

Credits

Charles Fol from LEXFO/AMBIONICS

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Authenticated Arbitrary File Read Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Authenticated Arbitrary File Read Vulnerability

Advisory ID

WGSA-2022-00013

WatchGuard Thu, 06/23/2022 - 13:50

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-05-17

Workaround Available

False

CVSS Score

6.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker to read arbitrary text files from the filesystem.

Affected

Fireware OS before 12.8, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10

Resolution

Fireware OS 12.8, 12.1.4, 12.5.10

Credits

Internally discovered

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Local Privilege Escallation Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Local Privilege Escallation Vulnerability

Advisory ID

WGSA-2022-00018

WatchGuard Thu, 06/23/2022 - 13:50

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

False

CVSS Score

4.4

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

A local privilege escalation vulnerability in Firebox and XTM devices could allow an attacker to execute commands with root privileges.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4 and 12.2.x through 12.5.x before 12.5.10.

Resolution

Fireware OS 12.8.1, 12.5.10, 12.1.4

Credits

Charles Fol from LEXFO/AMBIONICS

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox WebUI Stored Cross-Site Scripting (XSS) Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox WebUI Stored Cross-Site Scripting (XSS) Vulnerability

Advisory ID

WGSA-2022-00014

WatchGuard Thu, 06/23/2022 - 13:50

CVE

CVE-2022-31792

Impact

Medium

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

False

CVSS Score

6.8

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox and XTM appliances. An unauthenticated remote attacker can potentially execute arbitrary JavaScript code in the Firebox management interface by sending carefully crafted requests to exposed management ports.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10.

Resolution

Fireware OS 12.8.1, 12.5.10 and 12.1.4

Credits

Internally discovered

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge

Firebox Unauthenticated Buffer Overflow Vulnerability

WatchGuard — Thu, 23 Jun 2022 20:50:01 +0000

Firebox Unauthenticated Buffer Overflow Vulnerability

Advisory ID

WGSA-2022-00015

WatchGuard Thu, 06/23/2022 - 13:50

CVE

CVE-2022-31789

Impact

Critical

Status

Resolved

Product Family

Firebox

Published Date

2022-06-23

Updated Date

2022-06-17

Workaround Available

True

CVSS Score

9.8

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports.

Affected

Fireware OS before 12.8.1, 12.x before 12.1.4, and 12.2.x through 12.5.x before 12.5.10.

Resolution

Fireware OS 12.8.1, 12.5.10 and 12.1.4

Workaround

Follow WatchGuard's recommended best practices for remote management access and do not expose unrestricted management access to the internet.

Credits

Charles Fol from LEXFO/AMBIONICS

Advisory Product List

Product Family

Product Branch

Product List

Firebox

XTM 8 Series (2nd Gen)

XTM850, XTM860, XTM870, XTM870-F

Firebox

Firebox T (1st Gen)

T10, T10-W, T10-D, T30, T30-W, T50, T50-W

Firebox

XTM 1500 and 2520

XTM1520-RP, XTM1525-RP, XTM2520

Firebox

Firebox T (2nd Gen)

T15, T15-W, T35, T35-W, T35-R, T55, T55-W, T70

Firebox

Firebox T (3rd Gen)

T20, T20-W, T40, T40-W, T80

Firebox

Firebox M (1st Gen)

M200, M300, M400, M440, M500

Firebox

Firebox M (2nd Gen)

M270, M370, M470, M570, M670

Firebox

Firebox M (3rd Gen)

M290, M390, M590, M690, M4800, M5800

Firebox

XTMv

Small, Medium, Large, Datacenter

Firebox

FireboxV

Small, Medium, Large, XLarge

Firebox

FireboxCloud

Small, Medium, Large, XLarge