CVE-2025-9242

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 92.22%
EPSS Percentile: 99.82%
CISA KEV: YES — Known Exploited Vulnerability

Description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Published: 17-Sep-2025 15:15
Last Modified: 11-Aug-2026 02:59
EPSS Date: 2026-11-09
CWE: CWE-787

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2025-11-12
Remediation Due: 2025-12-03
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ; https://nvd.nist.gov/vuln/detail/CVE-2025-9242

CNA Products / Version Status

WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

11.0 ≤ version ≤ 11.12.4+541730 — affected (custom)
12.0 ≤ version < 12.11.4 — affected (custom)
2025.0 ≤ version < 2025.1.1 — affected (custom)

Platforms: Default
WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

12.0 ≤ version < 12.3.1+722811 — affected (custom)

Platforms: FIPS
WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

12.0 ≤ version < 12.5.13 — affected (custom)

Platforms: T15/T35

Affected Products / Versions

watchguard / fireware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 11.10.2 · before (exclusive) 12.11.4
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
watchguard / fireware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 11.10.2 · before (exclusive) 12.5.13
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
watchguard / fireware Source: NVD CPE · affected
Version / affected range: 2025.1
cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*

References

Last enrichment sync: 09-Nov-2026 21:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

More recently, in September 2025, WatchGuard patched an RCE vulnerability (CVE-2025-9242) affecting Firebox firewalls and almost identical to CVE-2025-14733. CISA Says Ransomware Gangs Are Exploiting WatchGuard Firebox RCE Flaw

CVE (1)

MITRE ATT&CK (1)

Vendors (1)

Products (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.