🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2025-9242

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

fireware os

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalNetwork Vulnerabilities~10 seconds

WatchGuard IKEv2 Out-of-Bounds Write Vulnerability

WatchGuard Fireware OS 11.10.2 to 11.12.4_Update1, 12.0 to 12.11.3, and 2025.1 contains an out-of-bounds write caused by improper handling in Mobile User VPN and Branch Office VPN with IKEv2 dynamic gateway peer, letting remote unauthenticated attackers execute arbitrary code. References: https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/ https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242 Remediation: Update to the latest Fireware OS version beyond 2025.1.

Used 18 times · 9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: fireware os

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →