Critical WatchGuard Firebox Vulnerability Exploited in Attacks

According to CISA, a recent critical vulnerability in WatchGuard Firebox firewalls has been exploited in the wild. Tracked as CVE-2025-9242 (CVSS 9.3), the out-of-bounds write flaw in the Fireware OS enables unauthenticated remote code execution and affects the mobile user VPN with IKEv2 and branch office VPNs using IKEv2 configured with a dynamic gateway peer. In late October, The Shadowserver Foundation warned that more than 73,000 WatchGuard Firebox appliances had not been patched against the bug.

CISA has added CVE-2025-9242 to its Known Exploited Vulnerabilities (KEV) list and urges federal agencies to patch within three weeks under Binding Operational Directive 22-01. WatchGuard has resolved the issue in Fireware OS versions 2025.1.1, 12.11.4, 12.5.13 and 12.3.1_Update3 (B722811), with no fixes planned for Fireware OS 11.x.

The vendor updated its advisory on 21 October to note the in-the-wild exploitation and to include indicators of compromise, while noting administrators should rotate all locally stored secrets on vulnerable Firebox appliances.