An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Nov. 12, 2025.

Exploitation active

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Watchguard
  • Firebox M270
  • Firebox M290
  • Firebox M370
  • Firebox M390
  • Firebox M440
  • Firebox M4600
  • Firebox M470
  • Firebox M4800
  • Firebox M5600
  • Firebox M570
  • Firebox M5800
  • Firebox M590
  • Firebox M670
  • Firebox M690
  • Firebox Nv5
  • Firebox T115-w
  • Firebox T125
  • Firebox T125-w
  • Firebox T145
  • Firebox T145-w
  • Firebox T15
  • Firebox T185
  • Firebox T20
  • Firebox T25
  • Firebox T35
  • Firebox T40
  • Firebox T45
  • Firebox T55
  • Firebox T70
  • Firebox T80
  • Firebox T85
  • Fireboxcloud
  • Fireboxv
  • Fireware

Configuration 1 [-]

AND
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*
OR cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.py cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242 cve-icon cve-icon
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 cve-icon cve-icon
History

Thu, 13 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard firebox M270
Watchguard firebox M290
Watchguard firebox M370
Watchguard firebox M390
Watchguard firebox M440
Watchguard firebox M4600
Watchguard firebox M470
Watchguard firebox M4800
Watchguard firebox M5600
Watchguard firebox M570
Watchguard firebox M5800
Watchguard firebox M590
Watchguard firebox M670
Watchguard firebox M690
Watchguard firebox Nv5
Watchguard firebox T115-w
Watchguard firebox T125
Watchguard firebox T125-w
Watchguard firebox T145
Watchguard firebox T145-w
Watchguard firebox T15
Watchguard firebox T185
Watchguard firebox T20
Watchguard firebox T25
Watchguard firebox T35
Watchguard firebox T40
Watchguard firebox T45
Watchguard firebox T55
Watchguard firebox T70
Watchguard firebox T80
Watchguard firebox T85
Watchguard fireboxcloud
Watchguard fireboxv
CPEs cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*
cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*
Vendors & Products Watchguard firebox M270
Watchguard firebox M290
Watchguard firebox M370
Watchguard firebox M390
Watchguard firebox M440
Watchguard firebox M4600
Watchguard firebox M470
Watchguard firebox M4800
Watchguard firebox M5600
Watchguard firebox M570
Watchguard firebox M5800
Watchguard firebox M590
Watchguard firebox M670
Watchguard firebox M690
Watchguard firebox Nv5
Watchguard firebox T115-w
Watchguard firebox T125
Watchguard firebox T125-w
Watchguard firebox T145
Watchguard firebox T145-w
Watchguard firebox T15
Watchguard firebox T185
Watchguard firebox T20
Watchguard firebox T25
Watchguard firebox T35
Watchguard firebox T40
Watchguard firebox T45
Watchguard firebox T55
Watchguard firebox T70
Watchguard firebox T80
Watchguard firebox T85
Watchguard fireboxcloud
Watchguard fireboxv
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 12 Nov 2025 17:45:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-11-12T00:00:00+00:00', 'dueDate': '2025-12-03T00:00:00+00:00'}

Wed, 12 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Oct 2025 13:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Sep 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Watchguard
Watchguard fireware
Vendors & Products Watchguard
Watchguard fireware

Wed, 17 Sep 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 17 Sep 2025 08:00:00 +0000

Type Values Removed Values Added
Title WatchGuard Firebox IKEv2 VPN Pre-Authentication Remote Code Execution WatchGuard Firebox iked Out of Bounds Write Vulnerability

Wed, 17 Sep 2025 07:45:00 +0000

Type Values Removed Values Added
Description An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.
Title WatchGuard Firebox IKEv2 VPN Pre-Authentication Remote Code Execution
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: WatchGuard

Published: 2025-09-17T07:29:23.738Z

Updated: 2025-11-14T22:30:31.226Z

Reserved: 2025-08-20T11:08:20.724Z

Link: CVE-2025-9242

cve-icon Vulnrichment

Updated: 2025-09-17T12:57:15.519Z

cve-icon NVD

Status : Analyzed

Published: 2025-09-17T08:15:33.960

Modified: 2025-11-14T02:00:02.350

Link: CVE-2025-9242

cve-icon Redhat

No data.