Security readout for executives and security teams
Plain-English summary
A flaw in WatchGuard Firebox VPN processing can let an unauthenticated remote attacker run arbitrary code. CISA lists CVE-2025-9242 as known exploited, making exposed or historically configured appliances an urgent compromise risk. Deleted vulnerable VPN configurations may not eliminate exposure when a static-gateway branch office VPN remains configured.
Executive priority
Immediate. Assign accountable owners to identify exposed Fireboxes, verify historical VPN configuration, follow WatchGuard remediation guidance, and investigate affected devices for compromise. CISA's KEV status means this should be handled as an active threat, with internet-facing and business-critical gateways addressed first.
Technical view
CVE-2025-9242 is a CWE-787 out-of-bounds write in Fireware OS's iked process. Crafted network input may cause unauthenticated remote code execution without user interaction. Exposure involves mobile user VPN with IKEv2 or branch office IKEv2 using dynamic gateway peers, including a documented residual-configuration scenario. The bundle names Fireware OS 11.0, 12.0, and 2025.0 but lacks build-level boundaries.
Likely exposure
Highest concern applies to reachable Fireboxes currently or previously using the specified IKEv2 configurations. A device may remain vulnerable after deleting them when a static-gateway branch office VPN remains. The supplied version data is insufficient to determine exact vulnerable and fixed builds; assess each appliance against WatchGuard's advisory.
Exploitation context
Active exploitation is supported by CISA's Known Exploited Vulnerabilities listing. A public WatchTowr repository is also referenced as exploit material, increasing practical risk. The supplied evidence does not describe campaign scope, threat actors, victim sectors, or reliable compromise indicators.
Researcher notes
The CVSS 4.0 score is 9.3 with network access, low complexity, no privileges, and no user interaction. Confidentiality, integrity, and availability impacts are rated high. Build-specific affected ranges, fixed versions, detection artifacts, exploitation prevalence, and technical root-cause details are not present in the supplied bundle; consult the vendor advisory before making precise exposure determinations.
Mitigation direction
- Follow WatchGuard's advisory to identify and install the appropriate corrected Fireware release.
- Prioritize affected Fireboxes reachable by untrusted networks or supporting the specified IKEv2 configurations.
- Assess historically deleted IKEv2 configurations, especially where a static-gateway branch office VPN remains.
- Apply WatchGuard-recommended mitigations if immediate upgrading is not possible.
- Treat potentially exploited appliances as incident-response candidates, not merely patching targets.
Validation and detection
- Inventory every Firebox model, Fireware version, build, and external exposure.
- Review current mobile user and branch office VPN configurations for affected IKEv2 modes.
- Determine whether affected IKEv2 configurations previously existed and were later deleted.
- Compare each appliance's exact build and configuration with WatchGuard's current advisory.
- After remediation, verify the corrected release is running and reassess for compromise evidence.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-9242 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——WatchGuardVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Source timelineWatchGuard
Updated to provide Indicators of Attack and additional remediation guidance due to potential active exploits in the wild.
- Source timelineWatchGuard
Updated to correct an error in the logging level required for the IDi payload size IOA.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-9242 added to CISA KEV
- Source timelineWatchGuard
Updated the IKE Process Hang Indicator of Attack with new information regarding tunnel traffic availabiltiy.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-11-12T00:00:00.000Z: CVE-2025-9242 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.watchguard.com/CVE-2025-9242CVE reference, WatchGuard · vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015CVE reference, WatchGuard · vendor-advisory
- https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242/blob/main/watchTowr-vs-WatchGuard-CVE-2025-9242.pyCVE reference, CISA-ADP · exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.