CVE-2026-13371 PUBLISHED

WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization

Assigner: WatchGuard
Reserved: 25.06.2026 Published: 02.07.2026 Updated: 02.07.2026

An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor WatchGuard
Product Fireware OS
Versions Default: unaffected
  • affected from 12.0 to 12.12 (incl.)
  • affected from 12.5 to 12.5.18 (incl.)
  • affected from 2025.1 to 2026.2 (incl.)

Credits

  • Cody Sixteen finder

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE

Impacts

  • CAPEC-586 Object Injection