CVE-2022-23176: WatchGuard Fireware management access privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, carries a CVSS of 8.8, and compromises the firewall itself, giving an attacker full control of a perimeter device.

What it is

WatchGuard Firebox and XTM appliances running Fireware OS allow a remote attacker holding unprivileged credentials to obtain a privileged management session through exposed management access. Because the flaw grants full administrative control of the firewall, it undermines the perimeter device itself and was added to CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker with low-privileged credentials gains a privileged management session, yielding high confidentiality, integrity and availability impact on the appliance. That effectively hands over control of the firewall, including its policy, VPN and logging functions.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), per the CVSS vector. The description ties it to exposed management access, so the management interface must be reachable by the attacker.

Exploitation

Listed in CISA KEV with a 2022-04-11 addition and 2022-05-02 remediation due date, and EPSS 30-day probability of 0.127 (96th percentile). References include third-party reporting of real-world exploitation; no ransomware campaign use is recorded.

What to do

• Upgrade Fireware OS to a fixed release: 12.7.2_U1 or later, 12.1.3_U3 or later for 12.x, and 12.5.7_U3 or later for 12.2.x through 12.5.x.
• Restrict management interface exposure to trusted networks only; do not leave management access reachable from the internet.
• Rotate credentials and review accounts with unprivileged access, since the flaw requires only low-privileged credentials.
• Audit management sessions and configuration changes for signs of unauthorized privileged access.
• Track CISA KEV remediation requirements and confirm patching against the vendor advisory.

Detection

• Monitor firewall management logins for unprivileged accounts establishing privileged or administrative sessions.
• Alert on management interface connections originating from unexpected or external source addresses.
• Review configuration changes and new administrative accounts created outside change windows.
• Correlate authentication events with the vendor's resolved-issues guidance to spot anomalous session behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.