Vulnerability-Lookup

FKIE_CVE-2025-9242

Vulnerability from fkie_nvd - Published: 2025-09-17 08:15 - Updated: 2026-08-10 19:59

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

References

URL	Tags
5d1c2695-1a31-4499-88ae-e847036fd7e3	https://psirt.watchguard.com/CVE-2025-9242	Broken Link
5d1c2695-1a31-4499-88ae-e847036fd7e3	https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py	Exploit
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242	US Government Resource

Impacted products

Vendor	Product	Version
watchguard	fireware	*
watchguard	firebox_m270	*
watchguard	firebox_m290	*
watchguard	firebox_m370	*
watchguard	firebox_m390	*
watchguard	firebox_m440	*
watchguard	firebox_m4600	*
watchguard	firebox_m470	*
watchguard	firebox_m4800	*
watchguard	firebox_m5600	*
watchguard	firebox_m570	*
watchguard	firebox_m5800	*
watchguard	firebox_m590	*
watchguard	firebox_m670	*
watchguard	firebox_m690	*
watchguard	firebox_nv5	*
watchguard	firebox_t20	*
watchguard	firebox_t25	*
watchguard	firebox_t40	*
watchguard	firebox_t45	*
watchguard	firebox_t55	*
watchguard	firebox_t70	*
watchguard	firebox_t80	*
watchguard	firebox_t85	*
watchguard	fireboxcloud	*
watchguard	fireboxv	*
watchguard	fireware	*
watchguard	firebox_t15	*
watchguard	firebox_t35	*
watchguard	fireware	2025.1
watchguard	firebox_m295	-
watchguard	firebox_m395	-
watchguard	firebox_m495	-
watchguard	firebox_m595	-
watchguard	firebox_m695	-
watchguard	firebox_t115-w	*
watchguard	firebox_t125	*
watchguard	firebox_t125-w	*
watchguard	firebox_t145	*
watchguard	firebox_t145-w	*
watchguard	firebox_t185	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Default"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThanOrEqual": "11.12.4+541730",
              "status": "affected",
              "version": "11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.11.4",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2025.1.1",
              "status": "affected",
              "version": "2025.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "FIPS"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.3.1+722811",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "T15/T35"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.5.13",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"
    }
  ],
  "cisaActionDue": "2025-12-03",
  "cisaExploitAdd": "2025-11-12",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "WatchGuard Firebox Out-of-Bounds Write Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "58DBE3BF-F432-4724-B76B-2FAF4BDB72C0",
              "versionEndExcluding": "12.11.4",
              "versionStartIncluding": "11.10.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB00A42A-2065-4914-80CA-981E62DEC2CC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FC5E2C2-B0E3-4879-9B7C-E6E84A7BEC4E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "22AC145E-2F33-4C0D-AA78-080CEA1980AB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F83640-57E7-4DF8-A201-E8D5722EF978",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F639188-7E3D-46B8-8443-5B1F32A3EC59",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB643AE5-6432-474F-BCF9-7A92B907EDE1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FC5CE7-00F5-40C4-877F-78D3DF6B01DC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "04B14406-F7EC-4573-8AF0-BCCBA9BD1A15",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D10EFE3-0342-4670-AC73-011D08A4CBEA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "68953F7A-9037-4848-9F7B-FD8E798CB761",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A49CF31-D888-4DAE-B1D4-2E4E5A98B38A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F14FE4A-4C09-4B2E-8D2C-ECA03FC62595",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "413CB88D-9755-43BF-9D76-4252C7151A84",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "902C261B-AE76-4F2A-B660-2C069692E95D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3781D2E-80EF-4F6C-BBC3-7570940A5EBF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D5FBFA4-219F-49F8-BD2C-415A621F6ED6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "157A59B2-F420-4203-92C4-412685C51893",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFD1036B-87F5-4523-B67C-0DE6E9AACE32",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA4FE4DD-A364-4D3C-B84A-516AFC05F5A4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8050A99B-C106-422D-9497-5E7C79FB89E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F2A1048-7830-4CEB-B6D1-4A4F0C10580F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F97AE5A0-E6E5-46BD-B05D-98E4253773F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD55ABF8-7C3C-476C-9A04-C889F3D8A21E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9882123D-992F-4BDA-8EE0-433A3AF62B54",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D86B0B2-D05B-4361-A02A-C1FEE2F710DD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E18330D2-E06A-4C5C-94A0-62F2F683E015",
              "versionEndExcluding": "12.5.13",
              "versionStartIncluding": "11.10.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC78E84B-C17B-44C5-9427-5EF97B90A6EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "12FED793-9DF3-46BB-AA64-3B1934123616",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3FF092A-6FCD-43AA-BF50-4695B1514988",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "615FF2CF-69DA-4890-9236-52D8D6FA0E71",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3439409-2FD6-447B-91CF-17D1C09E2A79",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "575CC5EE-0278-489B-AA95-5EC5058D6FB9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5597F672-3C72-4BCF-AD3F-F16B6913EC2F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E28F563C-BC6E-41FB-8C62-F56CC539D4DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2296AE00-4806-484D-BD1D-B58A8FB87CE0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9071315-92A1-45FA-A048-BB750A40EF76",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A435F5A-752F-44D7-8083-0C2670F26689",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "591A04F9-FF92-4484-91DC-F268805A8708",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "49672197-C3FA-42A5-A550-DCA5ED89D0FA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de escritura fuera de l\u00edmites en WatchGuard Fireware OS podr\u00eda permitir a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta tanto a la VPN de usuario m\u00f3vil con IKEv2 como a la VPN de sucursal que utiliza IKEv2 cuando se configura con un par de puerta de enlace din\u00e1mico. Esta vulnerabilidad afecta a Fireware OS 11.10.2 hasta e incluyendo 11.12.4_Update1, 12.0 hasta e incluyendo 12.11.3 y 2025.1."
    }
  ],
  "id": "CVE-2025-9242",
  "lastModified": "2026-08-10T19:59:12.133",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-9242",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-11T04:55:33.935049Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-17T08:15:33.960",
  "references": [
    {
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "tags": [
        "Broken Link"
      ],
      "url": "https://psirt.watchguard.com/CVE-2025-9242"
    },
    {
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
    }
  ],
  "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "type": "Secondary"
    }
  ]
}

CVE-2025-9242 (GCVE-0-2025-9242)

Vulnerability from cvelistv5 – Published: 2025-09-17 07:29 – Updated: 2026-08-10 15:28

Title

WatchGuard Firebox iked Out of Bounds Write Vulnerability

Summary

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-11 04:55 UTC

CWE

CWE-787

Assigner

WatchGuard CNA under the mitre root

CNA scorecard A 91/100 over 93 records in the last 180 days details

References

4 references

URL	Tags
https://psirt.watchguard.com/CVE-2025-9242	vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wg…	vendor-advisory
https://github.com/watchtowrlabs/watchTowr-vs-Wat…	exploit
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

3 products

Vendor	Product	Version
WatchGuard	Fireware OS	Affected: 11.0 , ≤ 11.12.4+541730 (custom) Affected: 12.0 , < 12.11.4 (custom) Affected: 2025.0 , < 2025.1.1 (custom)
WatchGuard	Fireware OS	Affected: 12.0 , < 12.3.1+722811 (custom)
WatchGuard	Fireware OS	Affected: 12.0 , < 12.5.13 (custom)

Date Public

2025-09-17 07:29

Credits

btaol

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9242",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-11T04:55:33.935049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-11-12",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:28.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-11-12T00:00:00.000Z",
            "value": "CVE-2025-9242 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Default"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThanOrEqual": "11.12.4+541730",
              "status": "affected",
              "version": "11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.11.4",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2025.1.1",
              "status": "affected",
              "version": "2025.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "FIPS"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.3.1+722811",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "T15/T35"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.5.13",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.3.1+722811",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.5.13",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "11.12.4+541730",
                  "versionStartIncluding": "11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.11.4",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2025.1.1",
                  "versionStartIncluding": "2025.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "btaol"
        }
      ],
      "datePublic": "2025-09-17T07:29:23.738Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "We have evidence that suggests this vulnerability is under active exploitation.\n\nIndicators of Attack\n\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\n\nAbnormally large IKE_AUTH request IDi payload\n\nWith iked diagnostic logging set to the Info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large IDi payload size (greater than 100 bytes) is a strong indicator of an attack.\nThe following example diagnostic log shows an example IDi payload size of 300 bytes.\n1970-01-01 01:00:00 iked (203.0.113.1\u003c-\u003e203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=300) CERT(sz=889) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\n\nIKE Process Hang\n\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\n\nIKED Process Crash\n\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T15:28:40.461Z",
        "orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "shortName": "WatchGuard"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.watchguard.com/CVE-2025-9242"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Fireware OS 2025.1.1, Fireware OS 12.11.4, Fireware OS 12.5.13, Fireware OS 12.3.1+722811"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-21T00:00:00.000Z",
          "value": "Updated to provide Indicators of Attack and additional remediation guidance due to potential active exploits in the wild."
        },
        {
          "lang": "en",
          "time": "2025-11-07T00:00:00.000Z",
          "value": "Updated to correct an error in the logging level required for the IDi payload size IOA."
        },
        {
          "lang": "en",
          "time": "2025-12-01T00:00:00.000Z",
          "value": "Updated the IKE Process Hang Indicator of Attack with new information regarding tunnel traffic availabiltiy."
        }
      ],
      "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "value": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\u2019s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 as a temporary workaround."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
    "assignerShortName": "WatchGuard",
    "cveId": "CVE-2025-9242",
    "datePublished": "2025-09-17T07:29:23.738Z",
    "dateReserved": "2025-08-20T11:08:20.724Z",
    "dateUpdated": "2026-08-10T15:28:40.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted