Vulnerability details
CVE-2025-9242
Actively exploitedWatchGuard Firebox iked Out of Bounds Write Vulnerability
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-12-03)
- Fireware OS — version 12.11.4 and later
- Fireware OS — version 2025.1.1 and later
- Fireware OS — version 12.3.1+722811 and later
- Fireware OS — version 12.5.13 and later
Official description
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (WatchGuard) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WatchGuard | Fireware OS | 11.0 ≤ v ≤ 11.12.4+541730 | CVEProject cvelistV5 (CNA) |
| WatchGuard | Fireware OS | 12.0 ≤ v < 12.11.4 | CVEProject cvelistV5 (CNA) |
| WatchGuard | Fireware OS | 12.0 ≤ v < 12.3.1+722811 | CVEProject cvelistV5 (CNA) |
| WatchGuard | Fireware OS | 12.0 ≤ v < 12.5.13 | CVEProject cvelistV5 (CNA) |
| WatchGuard | Fireware OS | 2025.0 ≤ v < 2025.1.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://psirt.watchguard.com/CVE-2025-9242 vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 vendor-advisory
- https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242 government-resource
Details
- Published
- 2025-09-17
- Last updated
- 2026-08-10
- State
- Published
- Assigner (CNA)
- WatchGuard
- Kolun priority
- 89 · Critical
CISA KEV catalog
- Date added
- 2025-11-12
- Due date
- 2025-12-03
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-787