Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-9242 (CVSS score: 9.3), an out-of-bounds write vulnerability affecting Fireware OS 11.10.2 up to and including
Analysis Summary
# Vulnerability: Critical Out-of-Bounds Write in WatchGuard Fireware OS
## CVE Details
- CVE ID: CVE-2025-9242
- CVSS Score: 9.3 (Critical)
- CWE: Out-of-bounds Write
## Affected Systems
- Products: WatchGuard Fireware OS (Firebox appliances)
- Versions:
- Fireware OS 11.10.2 up to and including 11.12.4\_Update1
- Fireware OS 12.0 up to and including 12.11.3
- Fireware OS 2025.1
- Configurations: Affects the `iked` process, reachable during the IKE handshake process.
## Vulnerability Description
This is an out-of-bounds write vulnerability residing within the `iked` process component of WatchGuard Fireware OS. The flaw stems from a missing length check on an identification buffer during the Internet Key Exchange (IKE) handshake. This allows a remote, unauthenticated attacker to write data outside the bounds of the intended buffer, potentially leading to arbitrary code execution. Crucially, certificate validation—which might mitigate the attack—occurs after the vulnerable code path is executed.
## Exploitation
- Status: Exploited in the wild (Added to CISA KEV Catalog)
- Complexity: Implied Low (Remote, unauthenticated access)
- Attack Vector: Network
## Impact
- Confidentiality: High (Potential for information disclosure due to arbitrary execution)
- Integrity: High (Potential for system compromise/malicious code execution)
- Availability: High (Potential for system disruption or denial of service)
## Remediation
### Patches
- Specific patched versions are not explicitly listed in the summary, but users must consult WatchGuard advisories for versions containing fixes for CVE-2025-9242 (including versions newer than the highest vulnerable versions listed).
- **Action Required:** Federal agencies advised to apply patches by December 3, 2025.
### Workarounds
- No specific workarounds were detailed in the provided context.
## Detection
- Indicators of Compromise (IoCs): No specific IoCs were detailed regarding observed exploitation patterns.
- Detection Methods and Tools: Monitor network traffic targeting the IKE process (usually UDP port 500 or 4500) for anomalous behavior during the initial handshake phase. Shadowserver data indicates over 54,000 instances were vulnerable as of November 12, 2025, suggesting widespread potential exposure.
## References
- Vendor Advisories: Refer to WatchGuard security advisories for specific patch release information related to CVE-2025-9242.
- Relevant Links:
- CISA KEV Catalog Update: cisa.gov/news-events/alerts/2025/11/12/cisa-adds-three-known-exploited-vulnerabilities-catalog
- Shadowserver Vulnerability Statistics: dashboard.shadowserver.org/statistics/combined/time-series/?date_range=30&source=isakmp_vulnerable&source=isakmp_vulnerable6&tag=cve-2025-9242%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on