CVE-2026-104381
CVE-2026-104381 · Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.
CVSS 6.0 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
fireware os
- Versions
- ≥ 2025.1, < 2026.4: Affected (custom)
- ≥ 12.0, < 12.12.4: Affected (custom)
Update to 12.12.4; Update to 2026.4
fireware os
- Versions
- ≥ 12.0, < 12.5.22: Affected (custom)
Update to 12.5.22