CVE-2025-9242

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-9242 9.8

WatchGuard · Firebox · Added 2025-11-12 · Published 2025-09-17

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityWatchGuard Firebox Out-of-Bounds Write Vulnerability

VendorWatchGuard

ProductFirebox

Date added2025-11-12

Due date2025-12-03

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.

NVD: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-31 01:47 UTC

Wall time120s

Searches8

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-9242
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015
https://arcticwolf.com/resources/blog/cve-2025-9242/
https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/
https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242
https://www.sentinelone.com/vulnerability-database/cve-2025-9242/
https://digital.nhs.uk/cyber-alerts/2025/cc-4716
https://www.cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog
https://thehackernews.com/2025/10/researchers-uncover-watchguard-vpn-bug.html
https://horizon3.ai/attack-research/vulnerabilities/cve2025-9242/
https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py

Hunting hypothesis agent

Hunt Suricata/Zeek for IKEv2 IKE_SA_INIT with WatchGuard vendor ID (VN=XX.XX.X BN=XXXXXX) followed by IKE_AUTH Identification payload over 512 bytes triggering OOB write in iked ike2_ProcessPayload_CERT; 513+ crash the service

Research details

Componentiked process (IKEv2 daemon) in WatchGuard Fireware OS, specifically the ike2_ProcessPayload_CERT function

PreconditionsNetwork reachability to UDP port 500 (IKEv2 service) on the WatchGuard Firebox; No authentication required (pre-authentication vulnerability); Target must run Fireware OS versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, or 2025.1; The IKEv2 service (iked process) must be reachable; Mobile User VPN with IKEv2 or Branch Office VPN using IKEv2 must be configured with a dynamic gateway peer. agent

DeliveryNetwork-based: attacker sends IKE_SA_INIT to UDP port 500, parses the WatchGuard vendor ID response to fingerprint firmware version (VN=XX.XX.X BN=XXXXXX), then sends an IKE_AUTH packet with an oversized Identification payload (513+ bytes) that triggers an out-of-bounds write in iked ike2_ProcessPayload_CERT. The stack buffer overflow enables unauthenticated RCE. Mobile User VPN with IKEv2 or Branch Office VPN using IKEv2 with a dynamic gateway peer must be configured.

Public PoCyes

PoC URLs https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242 Third-party repos; verify before use.

Advisoryhttps://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015

Exploit notesCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base Score: 9.8, CRITICAL). Attack complexity is LOW; no privileges or user interaction required. The watchTowr PoC (watchTowr-vs-WatchGuard-CVE-2025-9242.py) is a detection artifact generator with optional exploit mode. It fingerprints firmware via the WatchGuard vendor ID payload (VN=XX.XX.X BN=XXXXXX) in IKE_SA_INIT responses, then triggers the vulnerability by sending an IKE_AUTH Identification payload of 513+ bytes, causing an out-of-bounds write in iked ike2_ProcessPayload_CERT. The ROP chain uses firmware-specific gadget addresses (e.g., pop rcx; ret at 0x4225ab for 12.11.3) and shellcode spawns a reverse python3 shell via socket[41], connect[42], dup2[33], execve[59]. Fireware OS lacks modern exploit mitigations (no stack canaries, no ASLR). Confirmed exploitable on 12.11.3 (Build 719894). WatchGuard confirmed active exploitation in the wild.

SummaryCVE-2025-9242 is a critical stack-based buffer overflow (out-of-bounds write) in the iked process of WatchGuard Fireware OS, which powers Firebox firewall appliances. The vulnerability resides in the ike2_ProcessPayload_CERT function and is triggered by sending crafted IKEv2 VPN packets (IKE_SA_INIT followed by IKE_SA_AUTH) to UDP port 500 without authentication. WatchGuard confirmed active exploitation in the wild, and watchTowr Labs published a full proof-of-concept exploit on GitHub demonstrating remote code execution on unpatched appliances. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on November 12, 2025.

Tia coverage

First reported2025-09-17

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-confirms-watchguard-firebox-rce-cve-2025-14733-is-being-exp

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.