Critical WatchGuard Fireware IKEv2 Flaw (CVE-2025-9242) Enables Unauthenticated RCE
A critical out-of-bounds write vulnerability (CVE-2025-9242, CVSS 9.3) in WatchGuard Fireware’s IKEv2 VPN allows unauthenticated remote code execution on Firebox appliances. Attackers can exploit the iked process over the internet, achieving full control of affected devices. Exploitation is trivial in unpatched versions (11.10.2–11.12.4, 12.0–12.11.3, 2025.1). WatchGuard released patches (2025.1.1, 12.11.4, 12.5.13, 12.3.1_Update3). Firebox systems are frequently internet-exposed, making urgent patching essential.
CORTEX Protocol Intelligence Assessment
Business Impact: Critical exposure for enterprise edge infrastructure, enabling direct compromise of VPN gateways and lateral movement. Technical Context: Vulnerability in the iked process allows memory corruption and arbitrary code execution pre-authentication.
Strategic Intelligence Guidance
- Patch Fireware immediately to 2025.1.1 or later.
- Restrict VPN exposure to trusted IPs and enforce strong auth.
- Monitor logs for IKEv2 anomalies or unexplained restarts.
- Isolate management interfaces from the internet.
CVEs
Vendors
Threats
Targets
Intelligence Source: A Critical WatchGuard Fireware Flaw Could Allow Unauthenticated Code Execution | Oct 18, 2025