CVE-2025-9242
📋 TL;DR
An out-of-bounds write vulnerability in WatchGuard Fireware OS allows remote unauthenticated attackers to execute arbitrary code on affected systems. This affects Mobile User VPN and Branch Office VPN configurations using IKEv2 with dynamic gateway peers. Organizations running vulnerable Fireware OS versions are at risk of complete system compromise.
💻 Affected Systems
- WatchGuard Fireware OS
📦 What is this software?
Fireware by Watchguard
Fireware by Watchguard
Fireware by Watchguard
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the firewall, enabling data exfiltration, network pivoting, and persistent backdoor installation.
Likely Case
Attacker executes arbitrary code with firewall privileges, potentially intercepting VPN traffic, modifying firewall rules, or deploying ransomware.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the firewall device itself, though credential theft and lateral movement remain possible.
🎯 Exploit Status
Public exploit code available on GitHub, and CISA confirms active exploitation in the wild. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fireware OS 11.12.5, 12.11.4, and 2025.2
Vendor Advisory: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015
Restart Required: Yes
Instructions:
1. Download the appropriate patched version from WatchGuard support portal. 2. Backup current configuration. 3. Apply the update through the Web UI or CLI. 4. Reboot the firewall to complete installation.
🔧 Temporary Workarounds
Disable IKEv2 VPN with dynamic gateway
allTemporarily disable vulnerable VPN configurations until patching can be completed
Configure VPN settings to use static gateway or disable IKEv2 VPN services
Network segmentation and access control
allRestrict access to VPN services to trusted IP ranges only
Add firewall rules to limit VPN access to specific source IP addresses
🧯 If You Can't Patch
- Isolate affected firewalls from critical network segments using VLANs or physical segmentation
- Implement strict network monitoring and alerting for suspicious VPN connection attempts
🔍 How to Verify
Check if Vulnerable:
Check Fireware OS version and verify if Mobile User VPN or Branch Office VPN with IKEv2 and dynamic gateway peer is configuredCheck Version:
From CLI: show version | include FirewareVerify Fix Applied:
Verify Fireware OS version is 11.12.5, 12.11.4, 2025.2 or later, and confirm VPN services are functioning normally📡 Detection & Monitoring
Log Indicators:
- Unusual VPN connection attempts, especially from unexpected IP addresses
- Firewall process crashes or restarts
- Unauthorized configuration changes
Network Indicators:
- Suspicious IKEv2 negotiation patterns
- Unexpected outbound connections from firewall
- Anomalous VPN traffic volumes
SIEM Query:
source="firewall.log" AND ("IKEv2" OR "VPN") AND ("crash" OR "buffer" OR "overflow")