CVE-2026-13374

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-13374
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://psirt.watchguard.com/CVE-2026-13374
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00016 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m370:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m440:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4600:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m470:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4800:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5600:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m570:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5800:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m670:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t55:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t70:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxcloud:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxv:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_t15:-:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t35:-:*:*:*:*:*:*:*
History

25 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web (XSS o ’cross-site scripting’) vulnerabilidad en WatchGuard Fireware OS (módulo de Integración de Tecnología ConnectWise) permite XSS Almacenado. Esta vulnerabilidad es una ruta de ataque adicional sin mitigar para CVE-2025-13937. Este problema afecta a Fireware OS 12.4 hasta e incluyendo 12.12, 12.5 hasta e incluyendo 12.5.18, y 2025.1 hasta e incluyendo 2026.2.
Information

Published : 2026-07-03 00:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-13374

Mitre link : CVE-2026-13374

CVE.ORG link : CVE-2026-13374

JSON object : View

Products Affected

watchguard

  • firebox_m270
  • firebox_m5800
  • firebox_m4600
  • firebox_t80
  • firebox_m370
  • fireware
  • firebox_m395
  • firebox_m470
  • firebox_t25
  • firebox_nv5
  • firebox_m590
  • firebox_m595
  • firebox_t145-w
  • firebox_t20
  • firebox_m495
  • firebox_t85
  • firebox_t185
  • firebox_t115-w
  • firebox_m290
  • firebox_t70
  • firebox_t55
  • firebox_m5600
  • firebox_t40
  • fireboxcloud
  • firebox_m695
  • firebox_m4800
  • firebox_m670
  • firebox_m570
  • firebox_t35
  • firebox_m690
  • fireboxv
  • firebox_t125
  • firebox_t125-w
  • firebox_t45
  • firebox_t145
  • firebox_m390
  • firebox_m440
  • firebox_t15
  • firebox_m295
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')