Watch Guard CVE-2022-26318 RCE Detection, IOCs, and Prevention for Defenders | Cybersecurity Blog | Grey Noise
Summary: GreyNoise identified exploit activity targeting WatchGuard Firebox and XTM appliances as of February 27, 2022, which WatchGuard confirmed was related to CVE-2022-26318, an unauthenticated remote code execution flaw affecting Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. At the time of writing on March 17, 2022, no public proof-of-concept existed, and GreyNoise said it had reason to believe a sophisticated actor was exploiting the vulnerability, with observed payloads connecting over a TLS-wrapped TCP socket to port 4117 and sending a gzip-compressed POST to /agent/login with a Content-Length greater than 600 bytes.
What's compelling: GreyNoise assessed that a sophisticated actor was already exploiting this pre-auth RCE in the wild before any public proof-of-concept existed, and the patch shipped in the same Fireware update that addressed Cyclops Blink, so appliances left unpatched carry both exposures at once.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-26318
- Related
- CVE-2022-26318: Watch Guard Firebox and XTM Appliances Arbitrary Code Execution Known Exploited Vulnerabilities · Mar 25, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026