CVE-2022-23176

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to...

8.8 HighIn KEV

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 12.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

10.9%Up 9.8 points since Feb 24, 2022

What each source reports

NVD Score used 8.8

Record: CVE-2022-23176
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2022-23176
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2022-28267 8.8

Record: EUVD-2022-28267
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8x27-645q-g2rv 8.8

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to...

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. This vulnerability impacts Fireware OS before 11.7.2_U1, 12.x before 12.1.3_U3, and 12.2.x through 12.5.x before 12.5.7_U3.

Record: GHSA-8x27-645q-g2rv
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-269
Updated: 2026-11-02

CISA KEV No score

WatchGuard Firebox and XTM Privilege Escalation Vulnerability

WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.

Record: CVE-2022-23176
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23176 is a high vulnerability (CVSS 8.8) in Watchguard Firebox And Xtm, published February 24, 2022. CISA lists it as known to be exploited, since April 11, 2022. EUVD reports exploitation since April 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.9%, the 95th percentile. No source names a fixed version.