{"id":"CVE-2026-90442","kind":"vulnerability","aliases":["CVE-2026-90442"],"related":[],"title":"WatchGuard Fireware OS: certd buffer overflow lets an authenticated user crash or run code","description":"A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.","summary":"A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS lets an attacker who can reach the Firebox management interface crash the service. The sources say it could also be used to execute arbitrary code via a specially crafted request.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firebox","fireware-os","infrastructure","network-appliance","watchguard"],"not_affected_if":["fixed-fireware-version","management-interface-restricted"],"how_to_check":"- Check the installed Fireware OS version on the Firebox device (System Status or `show version` in the CLI) and compare it against the fixed version in the vendor advisory.\n- Confirm whether the management interface (Web UI / CLI) is reachable from untrusted networks.","fix":"- Upgrade Fireware OS to the fixed release listed in the WatchGuard advisory (version unknown from the sources).\n- Restrict access to the Firebox management interface to trusted administrative networks.","status":"open","published_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:08+00:00","updated_at":"2026-10-27T16:34:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T16:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Fireware OS to the fixed release listed in the WatchGuard advisory (version unknown from the sources).\n- Restrict access to the Firebox management interface to trusted administrative networks.","reach":"network","title":"WatchGuard Fireware OS: certd buffer overflow lets an authenticated user crash or run code","impact":"high","summary":"A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS lets an attacker who can reach the Firebox management interface crash the service. The sources say it could also be used to execute arbitrary code via a specially crafted request.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","firebox","fireware-os","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Certificate service crashes; possibly arbitrary code runs on the firewall.","analyst_note":"Find the WatchGuard advisory and the list of affected and fixed Fireware OS versions; the NVD entry alone does not give them.","how_to_check":"- Check the installed Fireware OS version on the Firebox device (System Status or `show version` in the CLI) and compare it against the fixed version in the vendor advisory.\n- Confirm whether the management interface (Web UI / CLI) is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["fixed-fireware-version","management-interface-restricted"],"who_is_affected":"Organizations running WatchGuard Firebox appliances with a vulnerable Fireware OS version where users can reach the management interface. The attacker needs valid credentials or an authenticated session for that interface. Devices already on a fixed release, or with the management interface restricted to trusted networks, carry less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000652,"input_tokens":3298,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-90442':17A,20A 'access':94C 'allow':89C 'also':64B 'applianc':28B 'arbitrari':69B,109C 'attack':48B,92C 'authent':9A,91C 'base':33B,79C 'buffer':5A,34B,80C 'certd':4A,38B,87C 'certif':39B,103C 'code':14A,70B,110C 'could':63B 'craft':74B,115C 'crash':11A,56B,101C 'cve':15A,18A 'execut':68B,108C 'firebox':21B,53B,97C 'firewar':2A,23B,44B,85C 'fireware-o':22B 'infrastructur':25B 'interfac':55B,99C 'let':7A,46B 'manag':40B,54B,98C,104C 'network':27B 'network-appli':26B 'os':3A,24B,45B,86C 'overflow':6A,35B,81C 'potenti':107C 'process':41B,88C 'reach':51B 'request':75B,116C 'run':13A 'say':61B 'send':112C 'servic':58B,105C 'sourc':60B 'special':73B,114C 'stack':32B,78C 'stack-bas':31B,77C 'use':66B 'user':10A 'via':71B 'vulner':82C 'watchguard':1A,29B,43B","nicknames":[],"mitigations":[],"who_affected":"Organizations running WatchGuard Firebox appliances with a vulnerable Fireware OS version where users can reach the management interface. The attacker needs valid credentials or an authenticated session for that interface. Devices already on a fixed release, or with the management interface restricted to trusted networks, carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90442","severity":null,"published_at":"2026-10-27T16:17:31+00:00","modified_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}