WatchGuard Fireware OS up to 11.12.4+541730/12.11.3/2025.1.0 Mobile User VPN/Branch Office VPN out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in WatchGuard Fireware OS up to 11.12.4+541730/12.11.3/2025.1.0. Affected is an unknown function of the component Mobile User VPN/Branch Office VPN. This manipulation causes out-of-bounds write. This vulnerability is handled as CVE-2025-9242. The attack can be initiated remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical was found in WatchGuard Fireware OS up to 11.12.4+541730/12.11.3/2025.1.0. Affected by this vulnerability is some unknown processing of the component Mobile User VPN/Branch Office VPN. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.

The weakness was released by btaol as wgsa-2025-00015. It is possible to read the advisory at watchguard.com. This vulnerability is known as CVE-2025-9242 since 08/20/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/13/2025).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/12/2025 with a due date of 12/03/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading to version 2025.1.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-29699) and CERT Bund (WID-SEC-2025-2071). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• WatchGuard Firebox

Productinfo

Vendor

• WatchGuard

Name

• Fireware OS

Version

• 11.12.4+541730
• 12.11.0
• 12.11.1
• 12.11.2
• 12.11.3
• 2025.0
• 2025.1.0

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion