CVE-2025-9242 KEV
9.8
CRITICAL · CVSS 3.1 · EPSS 91.3% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2025-12-03.
Description
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 91.3% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-787 |
| On CISA KEV | yes — remediate by 2025-12-03 |
| Public exploit | none known |
| Published | 2025-09-17 |
| Last modified | 2026-08-10 |
CISA KEV
| Name | WatchGuard Firebox Out-of-Bounds Write Vulnerability |
|---|---|
| Added | 2025-11-12 |
| Due | 2025-12-03 |
| Vendor / product | WatchGuard / Firebox |
| Ransomware use | none reported |
Affected (39)
| Vendor | Product |
|---|---|
| watchguard | firebox m270 |
| watchguard | firebox m290 |
| watchguard | firebox m295 |
| watchguard | firebox m370 |
| watchguard | firebox m390 |
| watchguard | firebox m395 |
| watchguard | firebox m440 |
| watchguard | firebox m4600 |
| watchguard | firebox m470 |
| watchguard | firebox m4800 |
| watchguard | firebox m495 |
| watchguard | firebox m5600 |
| watchguard | firebox m570 |
| watchguard | firebox m5800 |
| watchguard | firebox m590 |
| watchguard | firebox m595 |
| watchguard | firebox m670 |
| watchguard | firebox m690 |
| watchguard | firebox m695 |
| watchguard | firebox nv5 |
| watchguard | firebox t115-w |
| watchguard | firebox t125 |
| watchguard | firebox t125-w |
| watchguard | firebox t145 |
| watchguard | firebox t145-w |
| watchguard | firebox t15 |
| watchguard | firebox t185 |
| watchguard | firebox t20 |
| watchguard | firebox t25 |
| watchguard | firebox t35 |
| watchguard | firebox t40 |
| watchguard | firebox t45 |
| watchguard | firebox t55 |
| watchguard | firebox t70 |
| watchguard | firebox t80 |
| watchguard | firebox t85 |
| watchguard | fireboxcloud |
| watchguard | fireboxv |
| watchguard | fireware |
References
- https://psirt.watchguard.com/CVE-2025-9242
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015
- https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242
→ the Explorer · watch your stack · NVD