{"id":"CVE-2026-111107","kind":"vulnerability","aliases":["CVE-2026-111107"],"related":[],"title":"WatchGuard Fireware OS: crafted login request crashes management interface","description":"A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device. Traffic processing is not affected.","summary":"A NULL pointer dereference in the management interface of WatchGuard Fireware OS lets an unauthenticated remote attacker send a specially crafted login request that crashes the management service. Repeated exploitation ends all active administrator sessions and blocks management of the device, though traffic processing is not affected.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","fireware-os","infrastructure","network-appliance","watchguard"],"not_affected_if":["management-restricted-to-trusted-network"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:06+00:00","updated_at":"2026-10-27T16:34:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T16:34:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"WatchGuard Fireware OS: crafted login request crashes management interface","impact":"low","summary":"A NULL pointer dereference in the management interface of WatchGuard Fireware OS lets an unauthenticated remote attacker send a specially crafted login request that crashes the management service. Repeated exploitation ends all active administrator sessions and blocks management of the device, though traffic processing is not affected.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firewall","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"management service crashes, admin sessions drop, device management blocked","analyst_note":"Find the affected Fireware OS versions and the vendor fixed release in the WatchGuard advisory, and confirm the management interface exposure details; NVD linked page is the only source given.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["management-restricted-to-trusted-network"],"who_is_affected":"Organizations running WatchGuard Fireware OS firewalls whose management interface is reachable from the network by an attacker. Devices where the management interface is restricted to trusted administrative networks have a much smaller exposure. The sources do not list affected Fireware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000577,"input_tokens":3341,"output_tokens":486,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111107':12A,15A '-2026':11A,14A 'access':91C 'activ':57B,112C 'administr':58B,113C 'affect':71B,132C 'allow':84C 'applianc':23B 'attack':41B,88C 'block':61B 'craft':4A,45B,105C 'crash':7A,49B,97C 'cve':10A,13A 'derefer':28B,75C 'devic':65B,127C 'end':55B 'exploit':54B,109C 'firewal':16B 'firewar':2A,18B,35B,79C 'fireware-o':17B 'in-progress':116C 'infrastructur':20B 'interfac':9A,32B,83C,95C 'let':37B 'login':5A,46B,106C 'manag':8A,31B,51B,62B,82C,94C,99C,119C,124C 'network':22B,90C 'network-appli':21B 'null':26B,73C 'oper':120C 'os':3A,19B,36B,80C 'pointer':27B,74C 'prevent':123C 'process':68B,129C 'progress':118C 'remot':40B,86C 'repeat':53B,108C 'request':6A,47B,107C 'send':42B,102C 'servic':52B,100C 'session':59B,114C 'special':44B,104C 'termin':110C 'though':66B 'traffic':67B,128C 'unauthent':39B,87C 'vulner':76C 'watchguard':1A,24B,34B,78C","nicknames":[],"mitigations":[],"who_affected":"Organizations running WatchGuard Fireware OS firewalls whose management interface is reachable from the network by an attacker. Devices where the management interface is restricted to trusted administrative networks have a much smaller exposure. The sources do not list affected Fireware versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111107","severity":null,"published_at":"2026-10-27T16:17:29+00:00","modified_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}