CVE-2022-23176

Deeper analysis

WatchGuard Firebox and XTM appliances running Fireware OS versions prior to 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3 contain an authorization bypass in the management interface. The flaw permits a remote attacker who already possesses unprivileged credentials to obtain a privileged management session when management access is exposed to the network.

An attacker with low-privileged credentials can exploit the issue over the network without user interaction to achieve full administrative control, resulting in high impact to confidentiality, integrity, and availability as reflected in the CVSS 8.8 score. This effectively allows escalation from a limited account to complete device compromise.

Vendor release notes direct customers to apply the listed Fireware updates that correct the session-handling weakness. Public reporting indicates the vulnerability was exploited in the wild by Russian threat actors before WatchGuard issued a complete advisory, and the current EPSS score of 0.1017 reflects sustained exploitation interest after disclosure.