CVE-2026-13371 | THREATINT

Description

An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data endpoint, which performs unsafe deserialization of the attacker-supplied input.

PUBLISHED Reserved 2026-06-25 | Published 2026-07-02 | Updated 2026-07-07 | Assigner WatchGuard

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status

unaffected

12.0 (semver)

affected

12.5 (semver)

affected

2025.1 (semver)

affected

Credits

Cody Sixteen finder

References

www.watchguard.com/wgrd-psirt/advisory/wgsa-2026-00014 vendor-advisory

cve.org (CVE-2026-13371)

nvd.nist.gov (CVE-2026-13371)

Download JSON