CVE-2026-13728
WatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database
MEDIUM 5.9
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WatchGuard
- NVD status
- Modified
Description
In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.
Weaknesses (CWE)
- CWE-798 — Use of Hard-coded Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N | WatchGuard |
| CVSS 4.0 | MEDIUM 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · 5d1c2695-1a31-4499-88ae-e847036fd7e3 (Secondary) |
| CVSS 3.1 | MEDIUM 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-41458
- GCVE · GCVE-0-2026-13728
Affected configurations (NVD CPE)
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*≥ 12.1 < 12.12.1cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*≥ 2025.1 < 2026.2.1
Affected products
| Product | Versions |
|---|---|
| WatchGuard · Fireware OS | affected 2025.1 < 2026.2.1 ; affected 12.0 < 12.12.1 |
| WatchGuard · Fireware OS | affected 12.0 < 12.11.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |