CVE-2017-8056 json
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent.
published 2017-04-22 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17019
- cvss
- 5.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.1%
- EPSS 5.1% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall degradation in performance while the wgagent process recovers. An attacker could continuously send XML-RPC requests that contain references to external entities to perform a limited Denial of Service (DoS) attack against an affected Firebox.
Exploit prediction
5.08% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- sidertia.com https://www.sidertia.com/Home/Community/Blog/2017/04/17/Fixed-the-Fireware-Vulnerabilities-discovered-by-Sidertia referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com https://packetstormsecurity.com/files/142177/watchguardfbxtm-xxeinject.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
sidertia.com
/Home/Community/Blog/2017/04/17/Fixed-the-Fireware-Vulnerabilities-discovered-by-Sidertia
exploit, third-party-advisory
-
packetstormsecurity.com
/files/142177/watchguardfbxtm-xxeinject.txt
exploit, third-party-advisory, vdb-entry
-
watchguard.com
/support/release-notes/fireware/11/en-US/EN_ReleaseNotes_Fireware_11_12_2/index.html
release-notes, vendor-advisory
-
watchguardsupport.force.com
/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000KlBSAU
vendor-advisory
Sources
- CVE List CVE-2017-8056
- NVD CVE-2017-8056
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.