CVE-2022-23176
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Apr 11, 2022
- US federal agencies must remediate it by May 2, 2022 (BOD 22-01)
- First attack observed 20 days after disclosure
Apply updates per vendor instructions.
Source: CISA KEV · Feb 14, 2023 Feb 2, 2023 Apr 11, 2022 Mar 17, 2022
CVSS score8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HVendorswatchguard
Affected products
| Vendors | Product | Versions |
|---|---|---|
| watchguard | fireware | < 12.1.3 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.