ZeroDay Findings
Sign inSign up

Findings

CVE-2025-9242

WatchGuard Firebox Out-of-Bounds Write Vulnerability

Published Sep 17, 2025 · updated Aug 10, 2026 · WatchGuard Firebox

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 17, 2025 · Catalog

    Detected

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN usi

  2. Nov 12, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Dec 3, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Aug 10, 2026 · Catalog

    Updated

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN usi

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 3, 2025

Affected

  • cpe watchguard/firewareversion unspecified
  • cpe watchguard/fireware2025.1
  • vendor WatchGuard Fireboxversion unspecified

Sources

  • CISA KEVCVE-2025-9242

    WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.

    cisa.gov
  • CVE.orgCVE-2025-9242

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-9242

    30-day exploitation probability 91.3%

    first.org
  • NIST NVDCVE-2025-9242

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynam

    nvd.nist.gov

References