CVE-2025-9242

9.8

CRITICAL CVSS 3.1

WatchGuard Firebox Out-of-Bounds Write Vulnerability - [Actively Exploited]

Description

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.

INFO

Published Date :

Sept. 17, 2025, 8:15 a.m.

Last Modified :

Nov. 14, 2025, 2 a.m.

Remotely Exploit :

Yes !

Source :

5d1c2695-1a31-4499-88ae-e847036fd7e3

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Dec 03, 2025 | 4 days left

Alert Date: Nov 12, 2025 | 16 days ago

Description :

WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ; https://nvd.nist.gov/vuln/detail/CVE-2025-9242

Affected Products

The following products are affected by CVE-2025-9242 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Watchguard	fireware
2	Watchguard	firebox_m270
3	Watchguard	firebox_m290
4	Watchguard	firebox_m370
5	Watchguard	firebox_m390
6	Watchguard	firebox_m440
7	Watchguard	firebox_m470
8	Watchguard	firebox_m4800
9	Watchguard	firebox_m570
10	Watchguard	firebox_m5800
11	Watchguard	firebox_m590
12	Watchguard	firebox_m670
13	Watchguard	firebox_m690
14	Watchguard	firebox_t15
15	Watchguard	firebox_t20
16	Watchguard	firebox_t35
17	Watchguard	firebox_t40
18	Watchguard	firebox_t55
19	Watchguard	firebox_t70
20	Watchguard	firebox_t80
21	Watchguard	fireboxcloud
22	Watchguard	fireboxv
23	Watchguard	fireware_os
24	Watchguard	firebox_m4600
25	Watchguard	firebox_m5600
26	Watchguard	firebox_nv5
27	Watchguard	firebox_t25
28	Watchguard	firebox_t45
29	Watchguard	firebox_t85
30	Watchguard	firebox_t115-w
31	Watchguard	firebox_t125
32	Watchguard	firebox_t125-w
33	Watchguard	firebox_t145
34	Watchguard	firebox_t145-w
35	Watchguard	firebox_t185

: Total Affected Vendor : 1 | Products : 35

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Version	Severity	Source
CVSS 3.1	CRITICAL	[email protected]
CVSS 4.0	CRITICAL	5d1c2695-1a31-4499-88ae-e847036fd7e3
CVSS 4.0	CRITICAL	5d1c2695-1a31-4499-88ae-e847036fd7e3

Solution

Update Fireware OS to a patched version to fix the out-of-bounds write vulnerability.

Update Fireware OS to a version later than 12.11.3.
Apply updates for versions 11.12.4 and 2025.1.
Contact vendor for specific patch information.

Public PoC/Exploit Available at Github

CVE-2025-9242 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-9242.

URL	Resource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015	Vendor Advisory
https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py	Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-9242 is associated with the following CWEs:

CWE-787: Out-of-bounds Write

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-9242 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

B1ack4sh/Blackash-CVE-2025-9242

CVE-2025-9242

Updated: 6 days, 18 hours ago

1 stars 0 fork 0 watcher

Born at : Nov. 21, 2025, 8:12 a.m. This repo has been linked 1 different CVEs too.

pulsecipher/CVE-2025-9242

None

Updated: 1 month, 1 week ago

3 stars 0 fork 0 watcher

Born at : Oct. 17, 2025, 8:21 p.m. This repo has been linked 1 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 2 days, 7 hours ago

1 stars 0 fork 0 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 days, 10 hours ago

7400 stars 1218 fork 1218 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 825 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-9242 vulnerability anywhere in the article.

BleepingComputer

CISA warns Oracle Identity Manager RCE flaw is being actively exploited

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning government agencies to patch an Oracle Identity Manager tracked as CVE-2025-61757 that has been exploited in attacks, potentia ...

Published Date: Nov 21, 2025 (6 days, 5 hours ago)

The Cyber Express

Akira Ransomware Group Poses ‘Imminent Threat’ to Critical Infrastructure: CISA

The Akira ransomware group poses an “imminent threat to critical infrastructure,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today. CISA joined with the FBI, other U.S. ag ...