An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
References
| Link | Resource |
|---|---|
| https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Mar 2022, 15:07
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:watchguard:fireware:12.5.9:-:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.5.9:u1:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u6:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u2:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u1:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.7.2:u1:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u4:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u3:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.7.2:-:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u7:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:u5:*:*:*:*:*:* cpe:2.3:o:watchguard:fireware:12.1.3:-:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| CWE | CWE-190 | |
| References | (CONFIRM) https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html - Release Notes, Vendor Advisory |
24 Feb 2022, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-24 15:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-25291
Mitre link : CVE-2022-25291
CVE.ORG link : CVE-2022-25291
JSON object : View
Products Affected
watchguard
- fireware
CWE
CWE-190
Integer Overflow or Wraparound