Critical WatchGuard Vulnerability Lets Unauthenticated Attackers Run Arbitrary Code

WatchGuard has disclosed a critical vulnerability in its Firebox line, tracked as CVE-2025-9242, that allows an unauthenticated remote attacker to run arbitrary code due to an out-of-bounds write in the IKEv2 handling routine. The flaw affects a broad range of Fireware OS versions, including 11.10.2 through 11.12.4_Update1, the entire 12.0 series up to 12.11.3, and the 2025.1 release, with both mobile user VPN (IKEv2) and branch office VPN (IKEv2) configurations at risk when dynamic gateway peers were once in use.

The vulnerability is serious enough to be rated with a CVSS base score of 9.3, described as requiring low network attack complexity and no privileges or user interaction. WatchGuard has issued firmware updates to resolve the issue, and administrators are advised to upgrade to versions 2025.1.1, 12.11.4, 12.5.13, 12.3.1_Update3, or later, depending on model, to stay protected.

For environments where immediate upgrades aren’t feasible, the vendor suggests mitigations such as securing access to VPN tunnels and applying network segmentation and restricted IKEv2 traffic.