Firebox Management Privilege Escallation Vulnerability
Advisory ID
WGSA-2021-00004
CVE
CVE-2022-23176
Impact
High
Status
Resolved
Product Family
Firebox
Published Date
Updated Date
Workaround Available
True
CVSS Score
8.8
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
WatchGuard believes the sophisticated threat actor Sandworm is exploiting this vulnerability in the wild. Please see our Cyclops Blink FAQ for additional information.
Affected
Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Resolution
Fireware OS 12.7.2_U1, 12.5.7_U3, 12.1.3_U3
Workaround
This vulnerability requires network access to management (WSM or the WebUI) on affected devices. Firebox and XTM administrators should follow recommended best practices and restrict management access to trusted networks only.
Advisory Product List
Product Family
Product Branch
Product List
Firebox
XTM 8 Series (2nd Gen)
XTM850,
XTM860,
XTM870,
XTM870-F
Firebox
XTM 1500 and 2520
XTM1520-RP,
XTM1525-RP,
XTM2520
Firebox
Firebox T (1st Gen)
T10,
T10-W,
T10-D,
T30,
T30-W,
T50,
T50-W
Firebox
Firebox T (3rd Gen)
T20,
T20-W,
T40,
T40-W,
T80
Firebox
Firebox T (2nd Gen)
T15,
T15-W,
T35,
T35-W,
T35-R,
T55,
T55-W,
T70
Firebox
Firebox M (2nd Gen)
M270,
M370,
M470,
M570,
M670
Firebox
Firebox M (1st Gen)
M200,
M300,
M400,
M440,
M500
Firebox
Firebox M (3rd Gen)
M290,
M390,
M590,
M690,
M4800,
M5800
Firebox
FireboxV
Small,
Medium,
Large,
XLarge
Firebox
XTMv
Small,
Medium,
Large,
Datacenter
Firebox
FireboxCloud
Small,
Medium,
Large,
XLarge