高危
WatchGuard Firebox和XTM权限提升漏洞
2022-02-24 00:52:48 公开 ，2026-02-24 22:03:09 更新
- 关键漏洞
- CISA KEV
- 远程
- CWE Top 25 (2023)
- CWE Top 25 (2024)
- 公开PoC
- CWEs：
- CWE-269 （Improper Privilege Management）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-01-30 04:45:05
风险信息
- CVSS v2 向量
- AV:N/AC:L/Au:S/C:C/I:C/A:C
- CVSS v2 风险值
- 9
- CVSS v3 向量
- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 8.8
- CVSS v3.1 向量
- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Watchguard WatchGuard Fireware是美国WatchGuard（Watchguard）公司的一款防火墙操作系统。该系统支持入侵防护、垃圾病毒邮件过滤、SSL VPN等功能。WatchGuard Firebox和XTM设备允许具有非特权凭据的远程攻击者通过公开的管理访问权限访问具有特权管理会话的系统。此漏洞影响12.7.2_U1 之前的Fireware OS、12.1.3_U3之前的12.x以及12.5.7_U3之前的12.2.x到12.5.x。
- 修复建议
- 目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7/index.html#Fireware/en-US/resolved_issues.html
参考链接
- https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7/index.html#Fireware/en-US/resolved_issues.html
CVE · x_refsource_CONFIRM
- https://securityportal.watchguard.com
CVE · x_refsource_MISC
- https://cxsecurity.com/cveshow/CVE-2022-23176/
- https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE · x_refsource_MISC
- https://arstechnica.com/information-technology/2022/04/watchguard-failed-to-disclose-critical-flaw-exploited-by-russian-hackers/
CVE · x_refsource_MISC
- https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_1_3_U7/index.html#Fireware/en-US/resolved_issues.html
CVE · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23176
NVD · US Government Resource