{"id":"CVE-2025-9242","kind":"vulnerability","aliases":["CVE-2025-9242"],"related":[],"title":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated…","description":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.","summary":"WatchGuard Firebox firewalls have an out-of-bounds write in the iked process that handles IKE VPN negotiation. A remote unauthenticated attacker can run arbitrary code on the device, and CISA reports it is being exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-11-12T00:00:00+00:00","products":[{"name":"WatchGuard Firebox","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"watchguard fireware","fixed":["12.11.4"],"affected":">= 11.10.2, < 12.11.4","ecosystem":"vendor"},{"name":"watchguard fireware","fixed":["12.5.13"],"affected":">= 11.10.2, < 12.5.13","ecosystem":"vendor"},{"name":"watchguard fireware","fixed":[],"affected":"= 2025.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","firebox","firewall","infrastructure","vpn","watchguard"],"not_affected_if":["no-firebox-devices"],"how_to_check":null,"fix":"Apply the vendor mitigations per WatchGuard's advisory; the sources do not name a fixed version. If mitigations are unavailable, CISA says to discontinue use of the product.","status":"open","published_at":"2025-09-17T08:15:33+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:20+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:44:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per WatchGuard's advisory; the sources do not name a fixed version. If mitigations are unavailable, CISA says to discontinue use of the product.","reach":"internet","summary":"WatchGuard Firebox firewalls have an out-of-bounds write in the iked process that handles IKE VPN negotiation. A remote unauthenticated attacker can run arbitrary code on the device, and CISA reports it is being exploited in the wild.","category":"infrastructure","who_cares":["watchguard","firebox","vpn","firewall"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the firewall without logging in.","analyst_note":"Find WatchGuard's advisory for CVE-2025-9242 to get affected and fixed versions and the exact mitigation steps; check whether the iked vulnerability needs VPN enabled.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-firebox-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2545,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':21A,24A '-9242':22A,25A 'affect':106C 'allow':16A,95C 'arbitrari':65B,102C 'attack':62B,99C 'bound':5A,48B,84C 'branch':116C,143C,170C 'cisa':71B 'code':66B,103C 'configur':122C,133C,157C,180C 'cve':20A,23A 'delet':161C 'devic':69B 'dynam':125C,150C 'execut':101C 'exploit':34B,76B 'firebox':27A,35B,41B,130C,163C 'firewal':36B,42B 'firewar':11A,90C 'fireware':29A,31A,33A 'gateway':126C,151C,176C 'handl':55B 'ike':13A,52B,56B,92C 'ikev2':113C,120C,140C,147C 'infrastructur':37B 'may':15A,94C,164C 'mobil':109C,136C 'negoti':58B 'offic':117C,144C,171C 'os':12A,91C 'out-of-bound':2A,45B,81C 'peer':127C,152C,177C 'previous':132C 'process':14A,53B,93C 'remot':18A,60B,97C 'report':72B 'run':64B 'sinc':159C 'static':175C 'still':165C,179C 'unauthent':19A,61B,98C 'use':119C,146C 'user':110C,137C 'vpn':38B,57B,111C,118C,138C,145C,172C 'vulner':7A,86C,105C,167C 'watchguard':10A,26A,28A,30A,32A,39B,40B,89C 'wild':79B 'write':6A,49B,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-17T08:15:33+00:00","kev":{"dateAdded":"2025-11-12","dueDate":"2025-12-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-9242","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-9242","severity":null,"published_at":"2025-11-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-9242","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9242","severity":null,"published_at":"2025-09-17T08:15:33+00:00","modified_at":"2026-08-10T19:59:12+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}