Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-111107

Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WatchGuard

Description

A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WatchGuard Fireware OS

Default version status: unaffected

  • 2025.1 to < 2026.4affected
  • 12.0 to < 12.12.4affected

WatchGuard Fireware OS

Default version status: unaffected

  • 12.0 to < 12.5.22affected

References