WatchGuard Fireware OS IKEv2 Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-9242)
Executive & SecOps Summary
SECOPS ASSESSMENTWatchGuard Firebox appliances running Fireware OS with IKEv2 Mobile User VPN or Branch Office VPN (BOVPN) configured with a dynamic gateway peer (including legacy configurations where static peers remain active)
Unauthenticated remote attackers can execute arbitrary code with system privileges by sending specially crafted IKEv2 packets, leading to complete compromise of the appliance
Immediately upgrade to the patched Fireware OS version, or temporarily disable IKEv2 VPN services and restrict access to trusted IP addresses
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates provided by WatchGuard immediately. Use the following CLI commands to verify and upgrade the Fireware OS:
# Connect to the WatchGuard Firebox CLI to check system status and initiate the upgrade
# (Note: Replace the URL with the official secure image path appropriate for your model)
show system status
upgrade system from http://msc.watchguard.com/archive/fireware/latest-secure-image.sys2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the IKEv2 service (UDP ports 500 and 4500) to trusted source IP addresses only, or temporarily disable the vulnerable policy.
# Example CLI commands to disable the inbound IKEv2 policy to mitigate immediate risk
policy
edit 'IKEv2-Inbound'
set-state disabled
exit
write3. Log Audit & IoC Verification Commands
Monitor system logs for abnormal terminations of the iked process or memory corruption indicators.
# Search syslog or local log files for iked crashes or segmentation faults
grep -Ei 'iked.*crash|iked.*segfault|out-of-bounds' /var/log/messages
# Verify current active IKEv2 configurations and gateway status
show vpn ikev2-gatewayStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-9242) is an Out-of-bounds Write vulnerability (CWE-787) residing within the iked process (IPsec key exchange daemon) of WatchGuard Fireware OS. It occurs due to insufficient validation of input data length when parsing incoming IKEv2 protocol packets, allowing an attacker to write data past the allocated buffer boundaries.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending malicious IKEv2 key exchange packets to UDP ports 500 or 4500 on the target Firebox. When the iked daemon processes these packets, a buffer overflow is triggered, enabling the attacker to overwrite critical memory structures, hijack the execution flow, and execute arbitrary code. The vulnerability is active if IKEv2 Mobile VPN or BOVPN with a dynamic gateway peer is configured. Notably, if these configurations were previously created and subsequently deleted, the device remains vulnerable if a BOVPN to a static gateway peer is still configured.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk. It has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows full administrative control over the perimeter firewall, enabling attackers to perform lateral movement, intercept internal network traffic, harvest VPN credentials, and deploy ransomware across the enterprise network.
Official Vendor Advisories & References
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Frequently Asked SecOps Questions (CVE-2025-9242)
FAQQ1. How critical is CVE-2025-9242 and is it actively exploited in the wild?
CVE-2025-9242 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 92.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-9242?
Primary impacted vendors include watchguard across fireware. Scope summary: WatchGuard Firebox appliances running Fireware OS with active or legacy IKEv2 VPN configurations (Mobile VPN or dynamic peer BOVPN)
Q3. What temporary mitigations or workarounds exist for CVE-2025-9242 before patching?
[Mitigation] Immediately upgrade to the patched Fireware OS version, or temporarily disable IKEv2 VPN services and restrict access to trusted IP addresses Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-9242
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (watchguard)
View Category →Palo Alto Networks PAN-OS User-ID Authentication Portal Buffer Overflow RCE Vulnerability (CVE-2026-0300)
[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.
Google Chrome Skia Graphics Engine Out-of-bounds Write Vulnerability (CVE-2026-3909) Technical Advisory
[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.