Security readout for executives and security teams
Plain-English summary
This flaw lets a Firebox administrator store malicious browser code in SIP Proxy configuration. If another management user views the affected content, the code could run in that user’s Firebox management session. The required administrator access and user interaction limit urgency, but compromised or untrusted administrator accounts could use it to target other administrators.
Executive priority
Treat this as a normal-priority administrative security update, escalating where Firebox administration is broadly reachable, administrator accounts are shared, or compromise is suspected. It is not presented as an unauthenticated perimeter takeover. Exact patch urgency depends on WatchGuard’s affected-version guidance, which is not included in the supplied bundle.
Technical view
CVE-2025-6947 is a stored cross-site scripting vulnerability (CWE-79) in the Fireware OS management interface’s SIP Proxy configuration. Exploitation is remote and low complexity but requires administrator privileges and interaction by another management user. CVSS 4.0 is 4.8, with subsequent confidentiality and integrity impacts rated low and no stated availability impact.
Likely exposure
Potential exposure is limited to Firebox deployments using the vulnerable SIP Proxy management path where an attacker already has administrator privileges and another management user accesses the stored content. The bundle lists Fireware OS 12.0 twice as unaffected but identifies no affected versions, so exact version exposure cannot be determined from the supplied evidence.
Exploitation context
The attacker must authenticate remotely with administrator privileges, place malicious content in SIP Proxy configuration, and wait for another management user to interact with the affected interface. The bundle states KEV is false and provides no other evidence of active exploitation. No exploit code or demonstrated attack campaign is cited.
Researcher notes
The supplied affected-product data is internally unhelpful: Fireware OS 12.0 appears twice and is marked unaffected, while no affected range or fixed release is provided. Researchers should rely on the cited WatchGuard advisories for version boundaries and remediation details. The CVSS vector requires high privileges and passive user interaction, consistent with administrator-to-administrator stored XSS.
Mitigation direction
- Review the WatchGuard advisories for confirmed affected versions, fixed releases, and vendor-approved remediation.
- Apply the vendor-recommended Fireware update when applicable to the deployed appliance version.
- Restrict management-interface access to trusted administrative networks and authorized administrators.
- Review administrator accounts and revoke unnecessary or potentially compromised privileges.
- Limit SIP Proxy configuration changes until vendor remediation status is confirmed.
Validation and detection
- Inventory Firebox appliances and record each installed Fireware OS version.
- Compare installed versions with the WatchGuard advisories’ current affected and fixed-version information.
- Confirm management-interface access is restricted to authorized administrators and trusted network paths.
- Review SIP Proxy configuration and administrative changes for unexpected content or unauthorized modifications.
- Verify remediation through approved management-interface testing without using active exploit payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-6947 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N——WatchGuardVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.watchguard.com/CVE-2025-6947CVE reference, WatchGuard · vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00012CVE reference, WatchGuard · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.