Exploit for Watchguard-RCE-POC

kitploit · 2026-08-29

Description

RCE in Watchguard via CVE-2022-26318 with proof-of-concept exploit.

Entry point

Parameteragent.login · request body

Path/agent/login

Unauthenticated remote command execution via XML-RPC buffer overflow on WatchGuard Firebox/XTM admin interface (agent.login).

Affected Watchguard Fireware versions

Watchguard Fireware< 12.1.3, 12.5.9, 12.7.2

All known vulnerabilities by product

Fireware Os Watchguard Firebox Watchguard Xtm

CVSS 9.8 for CVE-2022-26318

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Exploit Details

Modified:2026-08-29 07:05

Last Seen:2026-08-29 08:26

Reporter:KitPloit

Tags

WatchguardRemote Code ExecutionCVE-2022-26318proof-of-conceptexploit

Other exploits for CVE-2022-26318

2026-09-01 KitPloitKITPLOIT

watchguard_cve-2022-26318

2026-09-01 KitPloitKITPLOIT

Watchguard-RCE-POC-CVE-2022-26318

2026-08-31 KitPloitKITPLOIT

Exploit for CVE-2022-26318

2024-12-05 egilasGITHUB

WatchGuard XTM Firebox Unauthenticated Remote Command Execution Exploit

2024-04-01 Dylan PindurZDTRuby

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

2024-03-29 Charles FOL, Dylan Pindur, h00die-gr3y, Misterxid, metasploit.comPACKETSTORMRuby

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

2022-08-29 h00die-gr3y <h00die.gr3y@gmail.com>, Charles Fol (Ambionics Security), Dylan Pindur (AssetNote), MisterxidMETASPLOITRuby

Exploit for CVE-2022-26318

2022-04-18 h3llk4t3GITHUB

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-H3LLK4T3-WATCHGUARD-RCE-POC-CVE-2022-26318
# Watchguard-RCE-POC-CVE-2022-26318

Watchguard RCE POC CVE-2022-26318 معرّف CVE لهذه الثغرة هو CVE-2022-26318.