High-Severity WatchGuard Flaws Risk VPN DoS and RCE via IKEv2 Memory Corruption

According to WatchGuard Technologies, a critical series of vulnerabilities across its Firebox product line in Fireware OS could allow attackers to crash VPN services, execute arbitrary code, and inject malicious commands into the management interface. One of the most disruptive flaws, CVE-2025-11838 (CVSS 8.7), targets the IKEv2 protocol and may let an unauthenticated attacker trigger a Denial of Service condition in both Mobile User VPNs and Branch Office VPNs.

The advisory notes that several flaws directly impact the Firebox management interface, including XPath Injection (CVE-2025-1545), and two CLI Command Injection issues (CVE-2025-12026 and CVE-2025-12195) that could enable authenticated, privileged users to execute arbitrary code. The vulnerabilities affect multiple Fireware OS versions, such as 12.x up to 12.11.4, 12.5.x up to 12.5.13, and 2025.1 up to 2025.1.2, with patches available in Fireware OS 12.11.5, 12.5.14 (for T15/T35 models), and 2025.1.3. Administrators are urged to upgrade promptly to mitigate the risk of DoS, remote code execution and compromised configurations.