{"id":"CVE-2026-90464","kind":"vulnerability","aliases":["CVE-2026-90464"],"related":[],"title":"WatchGuard Fireware OS: authenticated CLI command lets attacker write root-level files","description":"An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.","summary":"A WatchGuard Fireware OS firewall diagnostic command does not validate file paths, so an attacker with read-only Device Monitor access to the management CLI can create, truncate or overwrite arbitrary files. The same flaw lets them change kernel parameters with root privileges, though written content is limited to numeric values.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Fireware OS","fixed":["2026.4","12.12.4","12.5.22 (T15/T35)"],"affected":">= 2025.1, < 2026.4; >= 12.0, < 12.12.4; T15/T35 >= 12.0, < 12.5.22","ecosystem":"vendor"}],"ecosystems":[],"tags":["firewall","fireware-os","infrastructure","network-appliance","self-hosted","watchguard"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"In Fireware Web UI or CLI, check the running version (System Status / 'show version'). Exposed if it is >= 2025.1 and < 2026.4, or >= 12.0 and < 12.12.4, or T15/T35 >= 12.0 and < 12.5.22. Also list which accounts (including read-only Device Monitor) have management CLI access.","fix":"Upgrade Fireware OS to 2026.4 or later (2025.1/2026.x branch), 12.12.4 or later (12.x), or 12.5.22 or later (T15/T35 models).","status":"open","published_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:19+00:00","updated_at":"2026-10-27T16:36:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-27T16:34:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WatchGuard Fireware OS: authenticated CLI command lets attacker write root-level files","impact":"high","summary":"A WatchGuard Fireware OS firewall diagnostic command does not validate file paths, so an attacker with read-only Device Monitor access to the management CLI can create, truncate or overwrite arbitrary files. The same flaw lets them change kernel parameters with root privileges, though written content is limited to numeric values.","category":"infrastructure","nicknames":[],"who_cares":["watchguard","fireware-os","firewall","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gains root-level file writes and kernel parameter changes on firewall","analyst_note":"Find the WatchGuard advisory and the list of fixed Fireware OS versions and the diagnostic command name; the NVD entry alone gives no version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Organisations running WatchGuard Fireware OS firewalls with management CLI access enabled for Device Monitor accounts. Devices without CLI access granted to any user, or where only fully trusted administrators can log in, are less exposed. The sources do not name the affected Fireware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000583,"input_tokens":3345,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the WatchGuard advisory and the list of fixed Fireware OS versions and the diagnostic command name; the NVD entry alone gives no version or fix.","search":"'-2026':15A,18A '-90464':16A,19A 'access':55B,116C 'allow':101C 'applianc':29B 'arbitrari':65B,126C 'attack':8A,48B,105C 'authent':4A,104C 'chang':72B 'cli':5A,59B,120C 'command':6A,40B,100C,140C 'content':80B,142C 'control':88C 'craft':139C 'creat':61B,122C 'cve':14A,17A 'devic':53B,112C 'diagnost':39B,99C 'extern':87C 'file':13A,44B,66B,90C,127C 'firewal':22B,38B,98C 'firewar':2A,24B,36B,96C 'fireware':20A 'fireware-o':23B 'flaw':69B 'host':32B 'infrastructur':26B 'kernel':73B,130C 'least':108C 'let':7A,70B 'level':12A 'limit':82B,144C 'manag':58B,119C 'modifi':129C 'monitor':54B,113C 'network':28B 'network-appli':27B 'numer':84B,146C 'os':3A,21A,25B,37B,97C 'overwrit':64B,125C 'paramet':74B,131C 'path':45B,91C 'privileg':77B,114C,134C 'read':51B,110C 'read-on':50B,109C 'remot':103C 'root':11A,76B,133C 'root-level':10A 'self':31B 'self-host':30B 'special':138C 'submit':136C 'though':78B 'truncat':62B,123C 'valid':43B 'valu':85B,147C 'vulner':92C 'watchguard':1A,33B,35B,95C 'write':9A 'written':79B,141C","nicknames":[],"mitigations":[],"who_affected":"Any WatchGuard Firebox running an affected Fireware OS where a user, even a read-only Device Monitor account, can reach the management CLI. An attacker with such an account can overwrite files and change kernel parameters as root, with numeric-only content. Teams where only trusted admins have CLI access are lower risk; fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90464","severity":null,"published_at":"2026-10-27T16:17:31+00:00","modified_at":"2026-10-27T16:17:31+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-90464:888","url":null,"severity":null,"published_at":"2026-10-27T16:36:54+00:00","modified_at":"2026-10-27T16:36:54+00:00","first_seen_at":"2026-10-27T16:36:54+00:00","fetched_at":"2026-10-27T16:36:54+00:00","note":"WatchGuard PSIRT index lists CVE-2026-90464 (CVSS 7.2) with affected/fixed ranges; per-advisory page not retrievable, so diagnostic command name unknown and nothing marked verified. No exploitation or PoC found (not searched socially)."}],"documents":[{"id":6985,"url":"https://psirt.watchguard.com/","title":"WatchGuard Security Advisories (CVE-2026-90464 row)","kind":"advisory","source":"analyst","text":"WatchGuard PSIRT index row (psirt.watchguard.com, fetched 2026-10-27):\nSeverity 7.2 | CVE-2026-90464 Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root | Affected: Default >= 2025.1, < 2026.4; >= 12.0, < 12.12.4. T15/T35 >= 12.0, < 12.5.22. Fixed: >= 2026.4, >= 12.12.4; T15/T35 >= 12.5.22 | Published 2026-10-27\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}