WatchGuard Firebox Flaw Allows Attackers to Gain Unauthorized SSH Access

A security vulnerability has been discovered in WatchGuard Firebox devices that could allow attackers to bypass authentication and gain unauthorized SSH access to affected systems. Tracked as CVE-2025-59396, the flaw affects the SSH access control mechanisms of WatchGuard Firebox appliances, potentially enabling remote attackers to access the management interface without valid credentials.

The issue is particularly concerning because SSH is a primary management pathway for network administrators, and unauthorized access could give attackers control over firewall configurations, network traffic inspection, and security policies.

Organisations using affected Firebox models are urged to treat the vulnerability with high priority due to the direct access it provides to critical network infrastructure, and attackers exploiting the flaw could reconfigure firewall rules, disable logging, redirect traffic, or establish persistent backdoors.

WatchGuard has been notified, and administrators should monitor official security advisories for patches, while also implementing additional access controls, restricting SSH to trusted IP addresses, and considering disabling remote SSH management unless actively required.