CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

According to CISA, a critical security flaw in WatchGuard Fireware has been added to the KEV catalog after evidence of active exploitation. The vulnerability, CVE-2025-9242 (CVSS 9.3), is an out-of-bounds write flaw affecting Fireware OS versions from 11.10.2 up to 11.12.4_Update1, 12.0 up to 12.11.3, and 2025.1, and could allow a remote unauthenticated attacker to execute arbitrary code.

Shadowserver Foundation data cited by The Hacker News indicates that more than 54,300 Firebox instances remain vulnerable as of 12 November 2025, down from a peak of 75,955 on 19 October, with roughly 18,500 in the United States and significant numbers in Italy, the United Kingdom, Germany and Canada.

The advisory notes that the vulnerability stems from a missing length check in an identification buffer used during the IKE handshake, with pre-authentication code paths reachable, though details on exploitation scale are not disclosed. Federal Civilian Executive Branch agencies are urged to apply patches by 3 December 2025.