Critical WatchGuard Firebox Flaw (CVE-2025-59396, CVSS 9.8) Allows Unauthenticated Admin SSH Takeover via Default Credentials

A critical misconfiguration in WatchGuard Firebox devices has been disclosed as CVE-2025-59396 (CVSS 9.8), enabling unauthenticated administrators to take over via SSH using default credentials. The flaw affects Firebox appliances with default settings that expose port 4118 for administrative access, allowing attackers with network access to gain full administrative control.

Researchers Chanakya Neelarapu and Mark Gibson classified the vulnerability as a “Misconfiguration / Insecure Defaults” issue and explain that the default configuration through 2025-09-10 permits SSH access on port 4118 with the built‑in credentials admin:readwrite.

Once connected, an attacker can retrieve sensitive information such as ARP tables, network configurations, user accounts, feature keys and device location data, modify or disable firewall rules and policies, perform lateral movement, and exfiltrate data or disrupt services. The vulnerability stems from the insecure default configuration of the Firebox SSH service, meaning attackers can effectively own the firewall and pivot into the internal environment.

Given the predictable port and publicly documented defaults, mass scanning campaigns targeting unpatched or misconfigured Firebox devices exposed to the Internet are likely. According to Chanakya Neelarapu and Mark Gibson.