WatchGuard Fireware OS FireCluster Sync Missing Authentication Enables Root Firewall Management Actions

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.

• Fireware OS, Default configuration: affected in the branches >= 2025.1, < 2026.4 and >= 12.0, < 12.12.4. WatchGuard lists >= 2026.4 and >= 12.12.4 as not affected for the Default configuration.
• Fireware OS on T15/T35: affected in the branch >= 12.0, < 12.5.22. WatchGuard lists >= 12.5.22 as not affected.
• Additional configuration condition: the Firebox must be a member of a FireCluster. Branches or models outside these stated boundaries require separate verification and should not be assumed to be covered by a fix for another branch.

The flaw is in FireCluster Sync processing, where a specially crafted request can invoke privileged firewall management actions without authentication. The attacker must reach the cluster interconnect, for example through a compromised cluster peer or an on-path position on the network connecting the cluster. A Firebox must be configured as a member of a FireCluster to be exposed. The record describes the attack as requiring no prior privileges, no user interaction, and low complexity. The advisory classifies the issue as CWE-306 Missing Authentication for Critical Function and CWE-862 Missing Authorization, and also lists CWE-290 and CWE-77. The request format, protocol, parser, and specific execution path are not disclosed, so additional payload or endpoint details should not be inferred.

The vulnerability is reachable from the cluster interconnect rather than from an arbitrary network location. The described positions include a compromised cluster peer and an on-path attacker on the cluster network. The record states that the attack requires no authentication or prior privileges, no user interaction, and a low-complexity request. WatchGuard states that it is not aware of exploitation of this vulnerability in the wild. The record provides no public exploit, campaign, victim, or specific exploitation indicator.

• An unauthenticated request can trigger firewall management actions that run with root privileges.
• The technical result could include unauthorized changes to firewall state or configuration, affecting the integrity of security policy and the availability of the appliance.
• Root-level execution increases the possible consequences on the appliance, but the advisory does not enumerate every action the request can invoke.
• Reaching the cluster interconnect limits the attack path compared with an Internet-facing service; actual exposure depends on the design and protection of the cluster network.

• An attacker who reaches the cluster interconnect may perform privileged firewall management actions as root.
• This could enable unauthorized changes to firewall management state or policy, potentially weakening traffic controls, disrupting service, or leaving security configuration inconsistent.
• Because exposure depends on the cluster interconnect, the practical risk depends on how the organization protects the network linking FireCluster members.
• The record does not confirm a breach, data loss, or specific operational incident.

1. Upgrade Fireboxes in the Default branch beginning with 2025.1 to Fireware OS 2026.4.
2. Upgrade Fireboxes in the Default 12.0 branch to Fireware OS 12.12.4.
3. Upgrade T15/T35 Fireboxes to Fireware OS 12.5.22.
4. Inventory each appliance and release branch separately; do not treat a fix for one branch as evidence that every parallel branch is fixed.
5. If an immediate upgrade is not possible, treat the cluster interconnect as sensitive and review whether unauthorized access or on-path exposure can be reduced. This is temporary exposure reduction, not a replacement for installing a confirmed fixed Fireware OS release.

1. Inventory Firebox appliances configured as members of a FireCluster, which is the required exposure configuration.
2. Check the running Fireware OS version on those appliances and compare it with the affected branches listed in affected_summary.
3. Review the cluster topology and access paths to the cluster interconnect, including peers that could be compromised and positions from which traffic could be observed or modified in transit.
4. Review audit records for unexplained privileged firewall management actions or configuration changes during periods of possible exposure. This is a precautionary review, not a WatchGuard-confirmed log signature.
5. No specific IOC, log event, or request pattern is published. The absence of suspicious log evidence does not establish that a device is safe.