CVE-2022-23176 WatchGuard Firebox and XTM Privilege Escalation
Remote attackers with unprivileged credentials can gain privileged management access to WatchGuard Firebox appliances, enabling full system control.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23176?
CVE-2022-23176 is a high-severity authentication bypass vulnerability in Watchguard Fireware, published on 24 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.
Which versions are affected by CVE-2022-23176?
It affects 1 product.
Products include Watchguard Fireware.
How do I fix CVE-2022-23176?
No fix has been published for CVE-2022-23176 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 May 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-23176 being exploited?
Yes. Attackers have exploited CVE-2022-23176 in the wild since at least 11 Apr 2022.
Other vulnerabilities in Watchguard Fireware
Sources
Also known as GHSA-8x27-645q-g2rv.