ZeroDay Findings
Sign inSign up

Findings

CVE-2022-23176

WatchGuard Firebox and XTM Privilege Escalation Vulnerability

Published Feb 24, 2022 · updated Jun 16, 2026 · watchguard fireware

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 24, 2022 · Catalog

    Detected

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

  2. Apr 11, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 2, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

Required action

Apply updates per vendor instructions.

CISA due date May 2, 2022

Affected

  • cpe watchguard/firewareversion unspecified
  • cpe watchguard/fireware12.1.3
  • cpe watchguard/fireware12.5.7
  • vendor WatchGuard Firebox and XTMversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2022-23176

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2022-23176

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2022-23176

    30-day exploitation probability 10.8%

    first.org
  • NIST NVDVulnerability recordCVE-2022-23176

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through

    nvd.nist.gov

References

CVE-2022-23176 · ZeroDay Findings