CVE-2022-26318criticalunder attack

CVE-2022-26318

Published · Updated

Follow this CVE+ Monitor Firebox and XTM Appliances

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 78%
from disclosure to weapon24 days
Published on NVDMar 4
1st PoC+24d
metasploit+178d
CISA KEV+21d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

An unauthenticated attacker can execute arbitrary code on WatchGuard Firebox and XTM firewall appliances without needing credentials. This is critical because it allows complete compromise of the firewall, which is supposed to be a trusted security barrier.

Technical detail

Unauthenticated remote code execution in WatchGuard Fireware OS (versions <12.7.2_U2, 12.x <12.1.3_U8, 12.2.x-12.5.x <12.5.9_U2) allows arbitrary code execution on affected appliances. The attack vector is network-based and requires no prior authentication or user interaction, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.