Vulnerability · Published Dec 4, 2025 · Assigned by WatchGuard

CVE-2025-13940WatchGuard Firebox Boot Time System Integrity Check Bypass

Medium 6.7

In plain English

A medium-severity security flaw in Fireware OS from WatchGuard. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)6.7Medium

Exploit odds (30 days)0.1%top 97.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.

Affected products (as reported)

Vendor	Product	Versions
WatchGuard	Fireware OS	2025.1 – before 2025.1.312.8.1 – before 12.11.5

Weakness: CWE-440 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://psirt.watchguard.com/CVE-2025-13940 vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00026 vendor-advisory