WatchGuard

A stack-based buffer overflow in WatchGuard Fireware OS allows remote attackers to trigger a DoS or execute arbitrary code by tampering with FireCloud Gateway configuration payloads via man-in-the-middle attacks.

Threat actors are using typosquatted domains to harvest WatchGuard VPN credentials via fake portals before delivering legitimate software to maintain victim trust.

A missing authentication vulnerability in the WatchGuard Endpoint Security kernel memory access driver allows local attackers to perform arbitrary kernel memory access, potentially facilitating privilege escalation.

WatchGuard Fireware OS is impacted by multiple high-severity vulnerabilities allowing remote attackers to achieve arbitrary code execution, privilege escalation, and denial-of-service.

Multiple vulnerabilities in WatchGuard AP firmware versions prior to 3.4.8, including improper access control and command injection, could allow unauthenticated or authenticated attackers to execute arbitrary commands.

The IRON VIKING threat group has deployed an updated modular Cyclops Blink variant on Cisco Firewall Management Center devices, using SysV persistence and masquerading as a kernel thread to conduct reconnaissance and remote operations.

Multiple vulnerabilities in WatchGuard Fireware OS, including the Mobile Security component, allow unauthenticated remote attackers to execute arbitrary code via specially crafted network traffic.

The Qilin ransomware group, active since July 2022 and utilizing Golang, has claimed a new victim, Danone (International Delights) in the US Agriculture and Food Production sector, employing double extortion tactics involving data encryption and threatened data release.

WatchGuard has released security advisories to address critical vulnerabilities, including a race condition, use-after-free, and local privilege escalation, in its Fireware OS and Mobile VPN with SSL client for Windows, which could lead to remote code execution on appliances and local privilege escalation on client systems if not patched immediately.

Multiple vulnerabilities in WatchGuard Firebox appliances allow a remote, unauthenticated attacker to execute arbitrary code, cause a denial of service, manipulate or disclose data, and perform Cross-Site Scripting attacks, necessitating immediate patching to mitigate critical risks.

WatchGuard Agent on Windows (version 1.25.02.0000 and prior) is vulnerable to multiple privilege escalation and denial-of-service vulnerabilities, potentially allowing local attackers to execute arbitrary code with SYSTEM privileges or cause a denial of service.