CVE-2025-9242

What it actually does

This is a remotely exploitable out-of-bounds write in WatchGuard Fireware OS IKEv2 VPN handling. An unauthenticated attacker who can reach the VPN service can send crafted IKEv2 traffic to affected Mobile User VPN with IKEv2 or Branch Office VPN configurations using a dynamic gateway peer, corrupt memory, and potentially execute arbitrary code on the firewall. Because exploitation occurs before authentication and targets an internet-facing edge device, successful compromise can give the attacker control of the security appliance, enable traffic interception or tunneling, and provide a foothold into protected networks.

Why it matters to the business

This vulnerability affects perimeter firewalls and VPN gateways, so compromise can directly impact remote access, branch connectivity, network segmentation, and trust boundaries. Active exploitation is reported, the EPSS likelihood is very high, and the issue is listed in CISA KEV with a remediation deadline of 2025-12-03, making it a priority even where no incident is currently suspected. A successful attack can lead to firewall takeover, unauthorized network access, credential theft, service disruption, and use of the device as a persistence or relay point for follow-on intrusion activity.

How an attack unfolds

An attacker first identifies an internet-exposed WatchGuard Fireware device with IKEv2 VPN services reachable on UDP/500 and/or UDP/4500. They determine whether the target is running an affected Fireware OS version and whether Mobile User VPN with IKEv2 or Branch Office VPN with a dynamic gateway peer is enabled. The attacker then sends malformed IKEv2 negotiation traffic designed to trigger the out-of-bounds write before authentication completes. If exploitation succeeds, memory corruption is converted into code execution in the context of the vulnerable VPN/firewall process. From there, the attacker may attempt to execute commands, modify firewall or VPN configuration, create or alter administrative access, proxy traffic through the appliance, capture credentials or session material, and use the compromised edge device to move deeper into the network. Reported in-the-wild exploitation and references to LANDFALL-related activity increase the need to treat exposed affected devices as potentially targeted.

How to fix it

Upgrade affected WatchGuard Fireware OS deployments to a vendor-provided fixed release newer than the vulnerable ranges. The vulnerable ranges are Fireware OS 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1. If exact fixed versions are not already tracked internally, confirm the current WatchGuard security advisory and install the recommended fixed Fireware OS release for the device model. Until upgraded, reduce exposure by disabling Mobile User VPN with IKEv2 where feasible, disabling Branch Office VPN configurations that use IKEv2 with a dynamic gateway peer where feasible, limiting IKE/IKEv2 access to known trusted peer addresses, and blocking unnecessary inbound UDP/500 and UDP/4500 at upstream controls. Because this is a firewall/VPN edge-device RCE with active exploitation, do not rely on monitoring alone as a compensating control. After patching, review configuration integrity, administrator accounts, VPN users, certificates/keys, routing/NAT rules, policies, and management access settings for unauthorized changes.

How to confirm the fix worked

Confirm every WatchGuard Fireware device is inventoried with its exact Fireware OS version and VPN configuration state. A device should be considered exposed if it runs a vulnerable version and has Mobile User VPN with IKEv2 enabled or Branch Office VPN using IKEv2 with a dynamic gateway peer. Validate remediation by confirming the Fireware OS version is outside the vulnerable ranges and matches the vendor-recommended fixed release, then verify that UDP/500 and UDP/4500 are not reachable from untrusted networks unless explicitly required. Review the running and saved configurations to ensure temporary mitigations remain in place where patching is delayed. Perform an authenticated configuration audit and a controlled external scan to confirm IKEv2 exposure has been removed or restricted as intended.

Typical attack path

1. Scan the internet or known target ranges for WatchGuard Fireware devices exposing IKE/IKEv2 services on UDP/500 or UDP/4500.
2. Fingerprint the device and infer whether it may be running an affected Fireware OS release: 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, or 2025.1.
3. Identify reachable IKEv2 VPN configurations, especially Mobile User VPN with IKEv2 or Branch Office VPN using a dynamic gateway peer.
4. Send crafted unauthenticated IKEv2 packets that trigger the out-of-bounds write condition.
5. Achieve code execution or crash/restart behavior on the firewall process or appliance.
6. Establish persistence or operational access by changing configuration, adding administrative paths, modifying VPN settings, or deploying tooling where possible.
7. Use the firewall as a foothold to inspect, relay, or pivot traffic into internal networks.

How to detect it

Focus on whether vulnerable devices were exposed to untrusted IKEv2 traffic and whether they show signs of exploitation or post-exploitation activity. Review firewall, VPN, system, administrative audit, and network flow logs for inbound UDP/500 and UDP/4500 from unusual or high-volume external sources, repeated IKEv2 negotiation failures, malformed packet handling errors, VPN daemon crashes, unexpected appliance reboots, failovers, watchdog restarts, or core/crash dump generation. Correlate those events with subsequent administrative logins, configuration exports/imports, policy changes, VPN tunnel changes, new or modified users, authentication setting changes, certificate/key changes, routing/NAT changes, and unexpected outbound connections from the firewall. Because exploitation is memory-corruption based, there may be no reliable single log line proving exploitation; prioritize combinations of unsolicited IKEv2 traffic followed by instability or unauthorized configuration activity. If threat-intel enrichment is available, compare source IPs seen in IKEv2 traffic against infrastructure associated with active WatchGuard exploitation reporting and LANDFALL-related activity. For devices exposed while running vulnerable versions, collect and preserve support bundles, crash logs, configuration snapshots, administrative audit logs, VPN logs, and relevant NetFlow/packet metadata before rebooting or reimaging when possible.

What your security team should do

• Treat internet-exposed affected WatchGuard Fireware devices as urgent remediation targets because exploitation is active in the wild and EPSS is very high.
• Patch or upgrade all affected appliances before the CISA KEV due date of 2025-12-03; prioritize devices exposing UDP/500 or UDP/4500 to the internet.
• Immediately identify devices using Mobile User VPN with IKEv2 or Branch Office VPN with IKEv2 dynamic gateway peers and apply temporary exposure reduction if patching cannot be completed the same day.
• Restrict IKE/IKEv2 traffic to known peer IP addresses wherever operationally possible; avoid broad internet exposure for dynamic peer configurations.
• After remediation, conduct compromise assessment on devices that were exposed while vulnerable, including configuration review, admin account review, VPN user review, certificate/key review, and log review.
• Rotate credentials, VPN secrets, and certificates if there is evidence of compromise or if device integrity cannot be confidently established.
• Monitor for abnormal IKEv2 negotiation failures, firewall process crashes, unexpected reboots, configuration changes, new administrative access, and unusual outbound connections from the firewall.
• Escalate investigation for any exposed vulnerable device showing crash/restart events or configuration changes around unsolicited IKEv2 traffic.