A critical vulnerability has been discovered in WatchGuard 's Firebox firewalls , which could allow a remote, unauthorized attacker to execute arbitrary code on affected devices.
See also: Bitpixie vulnerability allows bypass of BitLocker encryption
The vulnerability, tracked as CVE-2025-9242, has been rated critical with a CVSS score of 9.3 out of 10. WatchGuard disclosed the issue in an advisory, WGSA-2025-00015, released on September 17, 2025, and is already providing updates to resolve the vulnerability.
The vulnerability is an out-of-bounds write issue within the iked process of WatchGuard's Fireware operating system. This process is responsible for managing Internet Key Exchange (IKE), a protocol used to establish secure VPN connections.
An attacker could exploit this flaw without requiring any authentication by sending specially crafted data to a vulnerable device. Successful exploitation allows the threat actor to execute arbitrary code, potentially leading to a full compromise of the firewall, allowing it to intercept network traffic, access internal networks, or disrupt security operations.
The critical nature of this vulnerability is reflected in its high CVSS score, which indicates a high impact on confidentiality, integrity, and availability.
See also: Critical vulnerabilities in Chaos Mesh allow RCE attacks
The vulnerability specifically affects Firebox devices running certain versions of Fireware OS when configured with specific VPN settings. The primary impacted configurations are mobile user VPN with IKEv2 and branch office VPN using IKEv2 with dynamic gateway peering.
The advisory also warns of a specific case: a Firebox may remain vulnerable if it was previously configured with one of these vulnerable VPN types, even if those configurations have been deleted, as long as a branch office VPN to a static gateway is still active.
WatchGuard has released patched versions of Fireware OS to address CVE-2025-9242. Administrators are strongly encouraged to upgrade their devices to the appropriate patched version as soon as possible. The recommended versions are 2025.1.1, 12.11.4, 12.5.13 (for T15 & T35 models), and 12.3.1_Update3 for the FIPS-certified version. For organizations that cannot immediately apply the updates, a temporary workaround is available.
See also: LG WebOS vulnerability allows full control of TV
This includes implementing WatchGuard security best practices to secure branch office VPNs that use IPSec and IKEv2, especially when configured with static gateway peers. However, applying official updates is the most effective way to fully mitigate the risk posed by this critical vulnerability.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
