WatchGuard Fireware OS: Stack-based buffer overflow in certd allows DoS and code execution
Summary
A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS affects Firebox firewalls. An authenticated attacker with access to the Firebox management interface can crash the certificate service and potentially execute arbitrary code by sending a specially crafted request. Exploitation requires valid high-privilege credentials, so exposure of the management interface is the key risk factor.
Affected
- Fireware OS 2025.1 to before 2026.4 (default)
- Fireware OS 12.0 to before 12.12.4
- Firebox T15/T35 with Fireware OS 12.0 to before 12.5.22
Fixed in
- Fireware OS 2026.4
- Fireware OS 12.12.4
- Fireware OS 12.5.22 (T15/T35)
Workaround
Unknown. The vendor has not published a workaround. Restricting access to the management interface reduces the risk.
Exploitation
WatchGuard is not aware of any exploitation of this vulnerability in the wild. Unknown whether public exploit code exists. Check the CISA Known Exploited Vulnerabilities catalog for current status.
Our recommendation
- Inventory all Firebox devices and their Fireware branch.
- Upgrade to 2026.4, 12.12.4 or 12.5.22, depending on the branch, after checking the vendor advisory.
- Restrict the management interface to trusted admin networks or a VPN and confirm it is not exposed to the internet.
- Review admin accounts and management logs for unusual activity and enforce MFA where supported.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WatchGuard PSIRT advisory CVE-2026-90442 psirt.watchguard.com
- OffSeq Radar: CVE-2026-90442 radar.offseq.com
- CVE-2026-90442 details (threatint) cve.threatint.com
- Strix CVE-2026-90442 www.strix.ai
- VulDB 427425 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:01.
Original description (NVD)
A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.