CVE-2025-13939

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

6.1

CVSS v4.0

4.8

EPSS

0.18%

Published

Dec 4, 2025

Modified

Dec 10, 2025

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.This issue affects Fireware OS 11.7.2 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (36)

watchguard · fireware (up to 2025.1.3)vulnerable

watchguard · firebox_t115-w

watchguard · firebox_t125

watchguard · firebox_t125-w

watchguard · firebox_t145

watchguard · firebox_t145-w

watchguard · firebox_t185

watchguard · fireware (up to 12.11.5)vulnerable

watchguard · firebox_m270

watchguard · firebox_m290

watchguard · firebox_m370

watchguard · firebox_m390

watchguard · firebox_m440

watchguard · firebox_m4600

watchguard · firebox_m470

watchguard · firebox_m4800

watchguard · firebox_m5600

watchguard · firebox_m570

watchguard · firebox_m5800

watchguard · firebox_m590

watchguard · firebox_m670

watchguard · firebox_m690

watchguard · firebox_nv5

watchguard · firebox_t20

watchguard · firebox_t25

watchguard · firebox_t40

watchguard · firebox_t45

watchguard · firebox_t55

watchguard · firebox_t70

watchguard · firebox_t80

watchguard · firebox_t85

watchguard · fireboxcloud

watchguard · fireboxv

watchguard · fireware (up to 12.5.14)vulnerable

watchguard · firebox_t15

watchguard · firebox_t35

References (1)

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00024

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs