What is CVE-2025-9242?

CVE-2025-9242 is a critical remote code execution vulnerability in WatchGuard Firebox appliances running Fireware OS. It exploits an out-of-bounds write in the IKEv2 VPN implementation, allowing an unauthenticated attacker to execute arbitrary code on the firewall without any credentials or user interaction.

Is there a public exploit available?

Yes, WatchTowr Labs has published a proof-of-concept exploit script on GitHub that demonstrates remote code execution against vulnerable Firebox devices. This means the barrier to exploitation is very low, and automated scanning for vulnerable devices is likely occurring.

Which Fireware OS versions are affected?

Fireware OS versions from 11.10.2 through 12.11.3 and the 12.5.x branch through 12.5.12 are affected, as well as the 2025.1 release. Organizations should upgrade to Fireware OS 12.11.4 or 12.5.13 depending on their release branch.

What makes this vulnerability particularly dangerous?

The combination of being remotely exploitable, requiring no authentication, having low attack complexity, and targeting an internet-facing VPN service makes this vulnerability exceptionally dangerous. Firewalls are critical security infrastructure, and compromising one gives an attacker a privileged position to monitor traffic, modify security rules, and pivot into the internal network.

CVE-2025-9242

CRITICAL(9.8)KEVLikely Exploited

WatchGuard Firebox Out-of-Bounds Write Vulnerability

Description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

KEV Information

Vendor

WatchGuard

Product

Firebox

Date Added

November 12, 2025

Due Date

December 3, 2025

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CWEs

CWE-787Out-of-bounds Write

Out-of-bounds Write

Affected Products

Vendor	Product	Version
watchguard	fireware	>= 11.10.2, < 12.11.4; >= 11.10.2, < 12.5.13; 2025.1

References

https://psirt.watchguard.com/CVE-2025-9242(Broken Link)
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015(Vendor Advisory)
https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py(Exploit)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242(US Government Resource)

CVSS Score

9.8

CRITICAL(9.8)

EPSS Score

EPSS Score91.25%

EPSS Percentile99.8%

Dates

PublishedSeptember 17, 2025

Last ModifiedAugust 10, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2025-9242

Description

KEV Information

CVSS Score

CWEs

Affected Products

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles