CVE-2026-13377: Stored XSS in WatchGuard Fireware SIP Proxy

Technical summary

CVE-2026-13377 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting the SIP Proxy module in WatchGuard Fireware OS. The flaw enables stored XSS attacks where maliciously crafted input is insufficiently sanitized before being rendered in web-facing interfaces. The CVSS 3.1 score of 4.8 (MEDIUM) reflects the requirement for high-privilege authentication (PR:H) and user interaction (UI:R) to trigger the payload, though the impact scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component. Notably, this CVE represents an incomplete remediation of CVE-2025-6947, indicating that the original patch may have addressed only one attack path while leaving this secondary route open.

Business impact

Stored XSS in a firewall management interface poses a moderate but meaningful risk. Compromised sessions or credentials could allow attackers to modify firewall policies, disable security rules, or exfiltrate network traffic insights. The requirement for high privilege and user interaction limits opportunistic exploitation, but persistent, supply-chain-aware threats could leverage this to establish long-term control. Organizations relying on WatchGuard appliances for network perimeter defense should prioritize understanding whether their administrative users have been exposed to malicious stored content. The fact that this is a secondary attack path for an already-known vulnerability may indicate that WatchGuard's initial mitigation was incomplete, raising questions about the thoroughness of the patch review process.

Affected systems

The vulnerability affects WatchGuard Fireware OS across a comprehensive product line: Firebox M-series appliances (M270, M290, M295, M370, M390, M395, M440, M470, M495, M4600, M4800, M570, M590, M595, M5600, M5800, M670, M690, M695), Firebox T-series (T15, T20, T25, T35, T40, T45, T55, T70, T80, T85, T115-W, T125, T125-W, T145, T145-W, T185), FireboxV, FireboxCloud, NV5, and likely other variants running vulnerable Fireware OS versions. Users should verify the exact version boundaries from WatchGuard's advisory to determine which specific firmware revisions are affected and which patches resolve the issue.

Exploitability

Exploitation requires high-privilege authentication (administrative access) and user interaction (a victim must view the stored payload). While this combination restricts casual or automated exploitation, it is realistic within organizational environments where admins regularly access the web console. An attacker who has compromised high-privilege credentials or who can socially engineer an admin into visiting a crafted link can inject persistent XSS. The stored nature of the attack means the payload persists across sessions, increasing the window for exposure. Public exploit code has not been reported, and the vulnerability is not yet tracked in CISA's Known Exploited Vulnerabilities catalog, but the moderate CVSS score and clear attack vector may attract research interest.

Remediation

Organizations should apply the latest WatchGuard Fireware OS security patch immediately, paying careful attention to ensure the patch addresses both this CVE and the original CVE-2025-6947 vulnerability. Because this issue represents an incomplete mitigation of a prior flaw, verify against WatchGuard's advisory that the new patch closes all identified attack paths in the SIP Proxy module, not just the originally documented one. If a patch is not yet available, restrict administrative access to the web console to trusted networks, enforce strong multi-factor authentication for admin accounts, and monitor for suspicious XSS payloads in logs. Consider using network segmentation to isolate management interfaces from untrusted segments.

Patch guidance

Check WatchGuard's security advisory for the specific Fireware OS versions that remediate CVE-2026-13377. Because this is an additional unmitigated path for CVE-2025-6947, verify that any patch released for the original CVE has been superseded or that a supplementary patch addressing this new vector is available. Apply patches to all affected Firebox models in your environment, starting with internet-facing or high-traffic appliances. Test patches in a staging environment before production deployment to ensure no regression in SIP Proxy functionality or other features. After patching, conduct a brief audit of stored content in the SIP Proxy module to identify any malicious payloads that may have been injected during the exposure window.

Detection guidance

Monitor Fireware OS web interface logs for unusual SIP Proxy configuration changes, especially changes made by high-privilege accounts during off-hours or from unexpected IP addresses. Look for HTML or JavaScript entities (encoded or plaintext) in SIP Proxy input fields or stored configurations. Deploy a Web Application Firewall (WAF) rule that detects common XSS patterns (script tags, event handlers, javascript: URIs) in HTTP requests to the Fireware management console. If SIEM or logging aggregation is in place, create alerts for any admin access to SIP Proxy pages followed by configuration changes. Review browser history and cached content on admin workstations for evidence of script injection if you suspect prior exploitation.

Why prioritize this

Although the CVSS score is MEDIUM (4.8), this vulnerability merits elevated attention due to its location in a critical security appliance and its role as a secondary, unpatched attack vector for an earlier vulnerability. The fact that CVE-2025-6947 was incompletely mitigated raises confidence that this attack path is real and possibly already understood by sophisticated actors. Organizations should treat this with the same or higher urgency than the base CVSS suggests, especially if they have not yet fully validated that their prior patch for CVE-2025-6947 eliminates all threats. Stored XSS in a firewall management interface is qualitatively more serious than XSS in a public-facing web application because the blast radius includes network security policy.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity (AC:L), (3) High privilege requirement (PR:H), (4) User interaction required (UI:R), (5) Changed scope (S:C), (6) Low confidentiality impact (C:L), (7) Low integrity impact (I:L), and (8) No availability impact (A:N). The privilege and interaction requirements reduce the score below 'HIGH', but the changed scope elevates it slightly. In context, a MEDIUM rating is appropriate for a stored XSS in a management interface, but organizations handling sensitive network infrastructure should apply additional risk weighting based on the potential for insider misuse or supply-chain compromise.

Frequently asked questions