CVE-2025-0178: WatchGaurd Firebox Host Header Injection Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-14 · updated 2026-08-08
Weakness: CWE-20

Description

An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.

Affected products

WatchGuard Fireware OS: from 12.0.0 before 12.11.1; from 12.5 before 12.5.13 — fixed in 12.11.1, 12.5.13

How to fix

Upgrade to a fixed version: WatchGuard Fireware OS 12.11.1, 12.5.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-0178 or the next vulnerability affects your stack