A critical WatchGuard Fireware vulnerability — Worrying WatchGuard VPN bug could let hackers hijack your devices - here's how to stay safe — was disclosed this month. CVE-2025-9242 lets unauthenticated attackers trigger remote code execution against affected Firebox devices using IKEv2 with dynamic gateway peers, so patching and quick mitigations are essential.
TL;DR — What happened and what to do now
-
A critical out-of-bounds write in WatchGuard Fireware (CVE-2025-9242) can allow unauthenticated remote code execution.
-
WatchGuard has published fixes; updated Fireware builds are available. Apply the patch now.
-
If you can’t patch immediately, follow WatchGuard’s recommended workarounds (disable dynamic BOVPN peers, tighten firewall policies, restrict internet access).
What CVE-2025-9242 actually is
CVE-2025-9242 is an out-of-bounds write vulnerability in the iked process of WatchGuard’s Fireware OS that affects IKEv2 VPN configurations using dynamic gateway peers. That means an attacker on the internet could — in the worst case — run code on the firewall without authenticating first.
Who’s affected
-
Firebox devices running affected Fireware versions across 11.x, 12.x and the 2025.1 builds were listed as vulnerable.
-
Devices that used IKEv2 dynamic peers previously may remain vulnerable even if those configs were later deleted, depending on remaining static peer settings — so don’t assume deletion fixed it.
Official patches and safe versions (apply these)
WatchGuard released fixed versions. Update to the first clean builds listed in their advisory (examples include 2025.1.1, 12.11.4, 12.5.13, and 12.3.1_Update3 depending on model). Check your product’s advisory and upgrade immediately.
If you can’t patch immediately — fast mitigations
If you cannot apply the patch right away, do the following now:
-
Disable dynamic peer BOVPNs until you can patch. This blocks the vulnerable path.
-
Add strict firewall rules to limit IKE and VPN traffic to known, trusted IPs only
-
Restrict internet access for exposed management interfaces and essential devices only.
-
Audit VPN configs — remove any unused IKEv2 profiles and confirm whether deleted configs left residual settings.
-
Monitor logs and alerts for unusual iked activity or signs of exploitation (unexpected reboots, new admin accounts, or unknown outbound connections).
How to check if you were targeted
-
Review firewall logs for anomalous iked behavior, spikes in VPN traffic, or failed/successful unexpected sessions.
-
Look for signs of post-exploitation: unexpected config changes, new admin users, or untracked outbound connections. If in doubt, escalate to your incident response team.
Quick checklist (copy-paste)
Why you should act fast
Public advisories and patch releases make vulnerabilities attractive to attackers — historically, many threat actors scan for targets immediately after a patch notice. Even though WatchGuard said they’ve seen no evidence of active exploitation so far, that can change quickly. Prioritise patching to avoid becoming an easy target.
Comment