CVE-2025-9242 (GCVE-0-2025-9242)

Vulnerability from cvelistv5 – Published: 2025-09-17 07:29 – Updated: 2026-08-10 15:28
VLAI CISA KEVIntel
Title
WatchGuard Firebox iked Out of Bounds Write Vulnerability
Summary
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: active Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
WatchGuard Fireware OS Affected: 11.0 , ≤ 11.12.4+541730 (custom)
Affected: 12.0 , < 12.11.4 (custom)
Affected: 2025.0 , < 2025.1.1 (custom)
Create a notification for this product.
WatchGuard Fireware OS Affected: 12.0 , < 12.3.1+722811 (custom)
Create a notification for this product.
WatchGuard Fireware OS Affected: 12.0 , < 12.5.13 (custom)
Create a notification for this product.
Date Public
2025-09-17 07:29
Credits
btaol
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: d8fbc910-3242-4f6e-ab55-164e43ede46a

Vulnerability ID: CVE-2025-9242

Status: Confirmed

Status Updated: 2025-11-12 00:00 UTC

Exploited: Yes

Timestamps
First Seen: 2025-11-12
Asserted: 2025-11-12
Scope
Notes: KEV entry: WatchGuard Firebox Out-of-Bounds Write Vulnerability | Affected: WatchGuard / Firebox | Description: WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-12-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ; https://nvd.nist.gov/vuln/detail/CVE-2025-9242
Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details
Cwes CWE-787
Feed CISA Known Exploited Vulnerabilities Catalog
Product Firebox
Due Date 2025-12-03
Date Added 2025-11-12
Vendorproject WatchGuard
Vulnerabilityname WatchGuard Firebox Out-of-Bounds Write Vulnerability
Knownransomwarecampaignuse Unknown
References
Created: 2026-02-02 12:25 UTC | Updated: 2026-02-06 07:17 UTC
KEVIntel
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 1ab4e49f-5be6-4d35-9f03-9d555c5231ca

Vulnerability ID: CVE-2025-9242

Status: Confirmed

Status Updated: 2026-06-01 10:44 UTC

Exploited: Yes

Timestamps
First Seen: 2026-06-01
Asserted: 2026-06-01
Scope
Notes: KEVIntel entry: WatchGuard Firebox iked Out of Bounds Write Vulnerability | Affected: WatchGuard / Fireware OS | CVSS: 9.3 (CRITICAL) | EPSS: 0.8637 | Used in malware: unknown | Not yet in CISA KEV: False
Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details
Feed KEVIntel (kevintel.com)
Title WatchGuard Firebox iked Out of Bounds Write Vulnerability
Vendor WatchGuard
Product Fireware OS
Added Date 2026-06-01T10:44:15.178Z
Cvss Score 9.3
Epss Score 0.8637
Cvss Severity CRITICAL
Epss Percentile 0.99709
Used In Malware unknown
Ahead Of Cisa Kev 
{
  "count": 1,
  "unit": "day"
}
Not Yet In Cisa Kev False
References
Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9242",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-11T04:55:33.935049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-11-12",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:28.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-11-12T00:00:00.000Z",
            "value": "CVE-2025-9242 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Default"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThanOrEqual": "11.12.4+541730",
              "status": "affected",
              "version": "11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "12.11.4",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2025.1.1",
              "status": "affected",
              "version": "2025.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "FIPS"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.3.1+722811",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "T15/T35"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.5.13",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.3.1+722811",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.5.13",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "11.12.4+541730",
                  "versionStartIncluding": "11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.11.4",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2025.1.1",
                  "versionStartIncluding": "2025.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "btaol"
        }
      ],
      "datePublic": "2025-09-17T07:29:23.738Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "We have evidence that suggests this vulnerability is under active exploitation.\n\nIndicators of Attack\n\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\n\nAbnormally large IKE_AUTH request IDi payload\n\nWith iked diagnostic logging set to the Info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large IDi payload size (greater than 100 bytes) is a strong indicator of an attack.\nThe following example diagnostic log shows an example IDi payload size of 300 bytes.\n1970-01-01 01:00:00 iked (203.0.113.1\u003c-\u003e203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=300) CERT(sz=889) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\n\nIKE Process Hang\n\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\n\nIKED Process Crash\n\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T15:28:40.461Z",
        "orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "shortName": "WatchGuard"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.watchguard.com/CVE-2025-9242"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Fireware OS 2025.1.1, Fireware OS 12.11.4, Fireware OS 12.5.13, Fireware OS 12.3.1+722811"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-21T00:00:00.000Z",
          "value": "Updated to provide Indicators of Attack and additional remediation guidance due to potential active exploits in the wild."
        },
        {
          "lang": "en",
          "time": "2025-11-07T00:00:00.000Z",
          "value": "Updated to correct an error in the logging level required for the IDi payload size IOA."
        },
        {
          "lang": "en",
          "time": "2025-12-01T00:00:00.000Z",
          "value": "Updated the IKE Process Hang Indicator of Attack with new information regarding tunnel traffic availabiltiy."
        }
      ],
      "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "value": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\u2019s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 as a temporary workaround."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
    "assignerShortName": "WatchGuard",
    "cveId": "CVE-2025-9242",
    "datePublished": "2025-09-17T07:29:23.738Z",
    "dateReserved": "2025-08-20T11:08:20.724Z",
    "dateUpdated": "2026-08-10T15:28:40.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2025-9242",
      "cwes": "[\"CWE-787\"]",
      "dateAdded": "2025-11-12",
      "dueDate": "2025-12-03",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ; https://nvd.nist.gov/vuln/detail/CVE-2025-9242",
      "product": "Firebox",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.",
      "vendorProject": "WatchGuard",
      "vulnerabilityName": "WatchGuard Firebox Out-of-Bounds Write Vulnerability"
    },
    "epss": {
      "cve": "CVE-2025-9242",
      "date": "2026-08-10",
      "epss": "0.91121",
      "percentile": "0.99799"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-9242\",\"sourceIdentifier\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"published\":\"2025-09-17T08:15:33.960\",\"lastModified\":\"2026-08-10T19:59:12.133\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de escritura fuera de l\u00edmites en WatchGuard Fireware OS podr\u00eda permitir a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta tanto a la VPN de usuario m\u00f3vil con IKEv2 como a la VPN de sucursal que utiliza IKEv2 cuando se configura con un par de puerta de enlace din\u00e1mico. Esta vulnerabilidad afecta a Fireware OS 11.10.2 hasta e incluyendo 11.12.4_Update1, 12.0 hasta e incluyendo 12.11.3 y 2025.1.\"}],\"affected\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"affectedData\":[{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Default\"],\"versions\":[{\"version\":\"11.0\",\"lessThanOrEqual\":\"11.12.4+541730\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"12.0\",\"lessThan\":\"12.11.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2025.0\",\"lessThan\":\"2025.1.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"FIPS\"],\"versions\":[{\"version\":\"12.0\",\"lessThan\":\"12.3.1+722811\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"T15/T35\"],\"versions\":[{\"version\":\"12.0\",\"lessThan\":\"12.5.13\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-11-11T04:55:33.935049Z\",\"id\":\"CVE-2025-9242\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2025-11-12\",\"cisaActionDue\":\"2025-12-03\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"WatchGuard Firebox Out-of-Bounds Write Vulnerability\",\"weaknesses\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.10.2\",\"versionEndExcluding\":\"12.11.4\",\"matchCriteriaId\":\"58DBE3BF-F432-4724-B76B-2FAF4BDB72C0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB00A42A-2065-4914-80CA-981E62DEC2CC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FC5E2C2-B0E3-4879-9B7C-E6E84A7BEC4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22AC145E-2F33-4C0D-AA78-080CEA1980AB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F83640-57E7-4DF8-A201-E8D5722EF978\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F639188-7E3D-46B8-8443-5B1F32A3EC59\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB643AE5-6432-474F-BCF9-7A92B907EDE1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08FC5CE7-00F5-40C4-877F-78D3DF6B01DC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04B14406-F7EC-4573-8AF0-BCCBA9BD1A15\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D10EFE3-0342-4670-AC73-011D08A4CBEA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68953F7A-9037-4848-9F7B-FD8E798CB761\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A49CF31-D888-4DAE-B1D4-2E4E5A98B38A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F14FE4A-4C09-4B2E-8D2C-ECA03FC62595\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"413CB88D-9755-43BF-9D76-4252C7151A84\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"902C261B-AE76-4F2A-B660-2C069692E95D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3781D2E-80EF-4F6C-BBC3-7570940A5EBF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D5FBFA4-219F-49F8-BD2C-415A621F6ED6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"157A59B2-F420-4203-92C4-412685C51893\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFD1036B-87F5-4523-B67C-0DE6E9AACE32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA4FE4DD-A364-4D3C-B84A-516AFC05F5A4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8050A99B-C106-422D-9497-5E7C79FB89E0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F2A1048-7830-4CEB-B6D1-4A4F0C10580F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F97AE5A0-E6E5-46BD-B05D-98E4253773F7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD55ABF8-7C3C-476C-9A04-C889F3D8A21E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9882123D-992F-4BDA-8EE0-433A3AF62B54\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D86B0B2-D05B-4361-A02A-C1FEE2F710DD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.10.2\",\"versionEndExcluding\":\"12.5.13\",\"matchCriteriaId\":\"E18330D2-E06A-4C5C-94A0-62F2F683E015\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC78E84B-C17B-44C5-9427-5EF97B90A6EF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12FED793-9DF3-46BB-AA64-3B1934123616\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FF092A-6FCD-43AA-BF50-4695B1514988\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"615FF2CF-69DA-4890-9236-52D8D6FA0E71\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3439409-2FD6-447B-91CF-17D1C09E2A79\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"575CC5EE-0278-489B-AA95-5EC5058D6FB9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5597F672-3C72-4BCF-AD3F-F16B6913EC2F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E28F563C-BC6E-41FB-8C62-F56CC539D4DD\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2296AE00-4806-484D-BD1D-B58A8FB87CE0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9071315-92A1-45FA-A048-BB750A40EF76\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A435F5A-752F-44D7-8083-0C2670F26689\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"591A04F9-FF92-4484-91DC-F268805A8708\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49672197-C3FA-42A5-A550-DCA5ED89D0FA\"}]}]}],\"references\":[{\"url\":\"https://psirt.watchguard.com/CVE-2025-9242\",\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015\",\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:16:22+00:00",
      "cve": "CVE-2025-9242",
      "id": "CVE-2025-9242",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9242.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9242\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-11T04:55:33.935049Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-11-12\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-11-12T00:00:00.000Z\", \"value\": \"CVE-2025-9242 added to CISA KEV\"}], \"references\": [{\"url\": \"https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py\", \"tags\": [\"exploit\"]}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-17T12:57:15.519Z\"}}], \"cna\": {\"title\": \"WatchGuard Firebox iked Out of Bounds Write Vulnerability\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"btaol\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}}], \"affected\": [{\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"11.12.4+541730\"}, {\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.11.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2025.0\", \"lessThan\": \"2025.1.1\", \"versionType\": \"custom\"}], \"platforms\": [\"Default\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.3.1+722811\", \"versionType\": \"custom\"}], \"platforms\": [\"FIPS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.5.13\", \"versionType\": \"custom\"}], \"platforms\": [\"T15/T35\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"We have evidence that suggests this vulnerability is under active exploitation.\\n\\nIndicators of Attack\\n\\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\\n\\nAbnormally large IKE_AUTH request IDi payload\\n\\nWith iked diagnostic logging set to the Info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large IDi payload size (greater than 100 bytes) is a strong indicator of an attack.\\nThe following example diagnostic log shows an example IDi payload size of 300 bytes.\\n1970-01-01 01:00:00 iked (203.0.113.1\u003c-\u003e203.0.113.2)\\\"IKE_AUTH request\\\" message has 6 payloads [ IDi(sz=300) CERT(sz=889) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\\n\\nIKE Process Hang\\n\\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\\n\\nIKED Process Crash\\n\\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-10-21T00:00:00.000Z\", \"value\": \"Updated to provide Indicators of Attack and additional remediation guidance due to potential active exploits in the wild.\"}, {\"lang\": \"en\", \"time\": \"2025-11-07T00:00:00.000Z\", \"value\": \"Updated to correct an error in the logging level required for the IDi payload size IOA.\"}, {\"lang\": \"en\", \"time\": \"2025-12-01T00:00:00.000Z\", \"value\": \"Updated the IKE Process Hang Indicator of Attack with new information regarding tunnel traffic availabiltiy.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Fireware OS 2025.1.1, Fireware OS 12.11.4, Fireware OS 12.5.13, Fireware OS 12.3.1+722811\"}], \"datePublic\": \"2025-09-17T07:29:23.738Z\", \"references\": [{\"url\": \"https://psirt.watchguard.com/CVE-2025-9242\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\\u2019s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 as a temporary workaround.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.3.1+722811\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.5.13\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"11.12.4+541730\", \"versionStartIncluding\": \"11.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.11.4\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2025.1.1\", \"versionStartIncluding\": \"2025.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"shortName\": \"WatchGuard\", \"dateUpdated\": \"2026-08-10T15:28:40.461Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-9242\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T15:28:40.461Z\", \"dateReserved\": \"2025-08-20T11:08:20.724Z\", \"assignerOrgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"datePublished\": \"2025-09-17T07:29:23.738Z\", \"assignerShortName\": \"WatchGuard\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.