CVE-2025-9242
WatchGuard Firebox Out-of-Bounds Write Vulnerability
Description
CVE-2025-9242 is a critical out-of-bounds write vulnerability in WatchGuard Fireware OS with a maximum CVSS v3.1 score of 9.8. The flaw affects the IKEv2 VPN implementation in WatchGuard Firebox devices, allowing a remote unauthenticated attacker to execute arbitrary code on the firewall appliance. Affected versions span Fireware OS 11.10.2 through 12.11.3 and 12.5.x through specific patch levels. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of December 3, 2025, and a public proof-of-concept exploit is available. The EPSS score of 0.61609 (98.3rd percentile) indicates an extremely high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| watchguard | fireware | >= 11.10.2, < 12.11.4; >= 11.10.2, < 12.5.13; 2025.1 |
References
- https://psirt.watchguard.com/CVE-2025-9242(Broken Link)
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015(Vendor Advisory)
- https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 occurs when a program writes data past the boundaries of allocated memory, potentially overwriting adjacent memory structures. This can lead to code execution, data corruption, or system crashes. In CVE-2025-9242, the WatchGuard Fireware OS IKEv2 VPN implementation writes beyond the bounds of a memory buffer during VPN session handling, allowing an attacker to overwrite critical data structures and achieve remote code execution on the firewall appliance.
Impact Analysis
The business impact of CVE-2025-9242 is extremely severe. Confidentiality, integrity, and availability are all rated as high, reflecting that successful exploitation grants the attacker complete control over the WatchGuard Firebox appliance. Since firewalls sit at network boundaries, compromising one provides an attacker with the ability to intercept all network traffic passing through the device, modify firewall rules to allow unauthorized access, use the compromised firewall as a pivot point into the internal network, and disrupt network connectivity for the entire organization.
The threat context amplifies the severity significantly. The EPSS score of 0.61609 (98.3rd percentile) indicates widespread active exploitation activity. The fact that this vulnerability requires no authentication, no user interaction, and is exploitable over the network with low complexity makes it an ideal target for automated mass scanning and exploitation. VPN endpoints are by design exposed to the internet, meaning the attack surface is inherently large. Organizations using Mobile User VPN with IKEv2 or Branch Office VPN with IKEv2 configured for dynamic gateway peers are directly at risk. Ransomware association is currently listed as unknown, but firewall compromise is a well-documented initial access vector for ransomware operators, as it provides both network access and the ability to disable security monitoring.
Exploit Maturity
CVE-2025-9242 has been confirmed as actively exploited in the wild with a publicly available proof-of-concept exploit. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of December 3, 2025. EPSS context: The score of 0.61609 (98.3rd percentile) places this among the most actively exploited vulnerabilities currently tracked.
Public exploit: WatchTowr Labs has published a proof-of-concept exploit on GitHub demonstrating remote code execution against vulnerable Firebox devices. The availability of a working exploit script means that even less sophisticated attackers can weaponize this vulnerability. Ransomware association: Currently unknown, but given that firewall compromise provides direct internal network access and the ability to disable security controls, this vulnerability represents a high-value target for ransomware operators.
Remediation
-
Upgrade Fireware OS immediately — Update all WatchGuard Firebox appliances to Fireware OS version 12.11.4 or 12.5.13, depending on your release branch. Consult the WatchGuard security advisory WGSA-2025-00015 for the specific patched versions applicable to your deployment.
-
Disable IKEv2 VPN if not required — If your organization does not actively use Mobile User VPN with IKEv2 or Branch Office VPN with IKEv2 using dynamic gateway peers, disable these features immediately as a workaround until patching is complete. Switch to alternative VPN protocols that are not affected by this vulnerability.
-
Implement network-level restrictions on VPN ports — If IKEv2 must remain active, apply IP-based access restrictions on UDP ports 500 and 4500 to limit which source IP addresses can initiate IKEv2 negotiations with the Firebox. While this does not eliminate the vulnerability, it significantly reduces the attack surface.
-
Monitor for exploitation indicators — Review firewall logs for unusual IKEv2 session activity, unexpected process crashes, or anomalous outbound connections from the Firebox management plane. Check for indicators of compromise associated with the published exploit.
-
Audit firewall configuration post-patch — After upgrading, verify that firewall rules, VPN configurations, and administrative accounts have not been tampered with. A compromised Firebox may have been used to establish persistent access or modify network security policies.
Technical Details
The CVSS v3.1 vector for CVE-2025-9242 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding the near-maximum critical score of 9.8. Attack Vector (Network) confirms the vulnerability is remotely exploitable, which is particularly impactful because VPN endpoints are intentionally internet-facing. Attack Complexity (Low) means the out-of-bounds write can be triggered reliably without special conditions. Privileges Required (None) and User Interaction (None) indicate a completely unauthenticated, automated attack is possible.
The vulnerability resides in the IKEv2 protocol handling within Fireware OS, specifically affecting both Mobile User VPN and Branch Office VPN when configured with dynamic gateway peers. During the IKEv2 negotiation process, the Fireware OS processes incoming IKE_SA_INIT or IKE_AUTH payloads and writes data into a fixed-size buffer. A crafted IKEv2 packet with oversized or malformed payload fields causes the processing routine to write beyond the allocated buffer boundary. This out-of-bounds write corrupts adjacent memory, which the attacker can leverage to overwrite function pointers or control structures, ultimately redirecting execution to attacker-controlled shellcode. The affected version range is extensive, spanning from Fireware OS 11.10.2 through 12.11.3 and through 12.5.12 on the 12.5.x branch, as well as the 2025.1 release. The Scope (Unchanged) metric indicates the impact is confined to the Firebox appliance itself, though in practice, compromising a network firewall has cascading effects on the entire protected network.
Frequently Asked Questions
What is CVE-2025-9242?
CVE-2025-9242 is a critical remote code execution vulnerability in WatchGuard Firebox appliances running Fireware OS. It exploits an out-of-bounds write in the IKEv2 VPN implementation, allowing an unauthenticated attacker to execute arbitrary code on the firewall without any credentials or user interaction.
Is there a public exploit available?
Yes, WatchTowr Labs has published a proof-of-concept exploit script on GitHub that demonstrates remote code execution against vulnerable Firebox devices. This means the barrier to exploitation is very low, and automated scanning for vulnerable devices is likely occurring.
Which Fireware OS versions are affected?
Fireware OS versions from 11.10.2 through 12.11.3 and the 12.5.x branch through 12.5.12 are affected, as well as the 2025.1 release. Organizations should upgrade to Fireware OS 12.11.4 or 12.5.13 depending on their release branch.
What makes this vulnerability particularly dangerous?
The combination of being remotely exploitable, requiring no authentication, having low attack complexity, and targeting an internet-facing VPN service makes this vulnerability exceptionally dangerous. Firewalls are critical security infrastructure, and compromising one gives an attacker a privileged position to monitor traffic, modify security rules, and pivot into the internal network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.