CVE-2025-13940

MediumCVSS 5.5/10Last modified Sep 25, 2026

Description

An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-440

Affected software

Vendor	Product	Versions
WatchGuard	Fireware OS	>= 2025.1, < 2025.1.3; >= 12.8.1, < 12.11.5

References

Timeline

Published: Dec 4, 2025
Last modified: Sep 25, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-139418.8A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file CVE-2025-139429.8A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remo CVE-2025-139438.8A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.5 CVE-2025-139455.5HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service CVE-2025-139465.5MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service CVE-2025-139477.4A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is p CVE-2025-139485.6A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-com CVE-2025-139496.3A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileCo CVE-2025-13958.2Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson a CVE-2025-139505.3The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c CVE-2025-139529.8A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free c CVE-2025-139539.3Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) logi