CVE-2025-9242: WatchGuard Fireware OS iked out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution on internet-facing VPN appliances, listed in CISA KEV with a public exploit and very high EPSS probability.

What it is

WatchGuard Fireware OS contains an out-of-bounds write in the iked process that can let a remote, unauthenticated attacker execute arbitrary code. It affects mobile user VPN with IKEv2 and branch office VPN using IKEv2 with a dynamic gateway peer, and a Firebox may remain exposed even after those configurations are deleted if a static-gateway branch office VPN is still configured. Because the flaw is reachable over the network with no credentials, it is a serious perimeter risk for internet-facing Fireboxes.

Impact

A successful attacker can execute arbitrary code on the Firebox, potentially gaining full control of the device and the network traffic and tunnels it terminates. That can expose or disrupt the VPN-protected networks behind it.

Attack surface

The flaw is reached over the network through the iked process handling IKEv2, with no authentication or user interaction required per the CVSS vector (AV:N/PR:N/UI:N). Any Firebox running an affected configuration with IKEv2 exposed is a candidate target.

Exploitation

CVE-2025-9242 is listed in CISA KEV (added 2025-11-12) and has a public proof-of-concept exploit reference, and EPSS gives it a 0.913 30-day probability (99.8th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Apply the WatchGuard Fireware OS update referenced in advisory WGSA-2025-00015 as soon as possible.
• If patching is not immediately possible, disable or restrict IKEv2 mobile user VPN and dynamic-gateway branch office VPN configurations, and review Fireboxes that previously had those configurations deleted but still run a static-gateway branch office VPN.
• Limit IKEv2 exposure to trusted source addresses where operationally feasible, and follow CISA BOD 22-01 guidance or discontinue use if mitigations are unavailable.
• Monitor WatchGuard advisories and CISA KEV for updated guidance and due dates (KEV remediation due 2025-12-03).

Detection

• Review Firebox configuration and logs for IKEv2 mobile user VPN or dynamic-gateway branch office VPN settings, including deleted configurations, to identify exposed devices.
• Monitor iked process crashes, restarts or abnormal behavior on Fireboxes, which may indicate exploitation attempts.
• Hunt for unexpected outbound connections, new accounts or configuration changes on Firebox management interfaces following IKEv2 traffic.
• Use the public proof-of-concept reference to build detection signatures for IKEv2 traffic patterns associated with the flaw.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.