Researchers Uncover WatchGuard VPN Bug That Could Let Attackers Take Over Devices

Cybersecurity researchers have disclosed details of a critical WatchGuard Fireware vulnerability, CVE-2025-9242, described as an out-of-bounds write that could allow a remote unauthenticated attacker to execute arbitrary code. The flaw affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3, and 2025.1, and is tied to the IKEv2 processing path used by both mobile user VPN and branch office VPN when configured with a dynamic gateway peer.

WatchGuard said in an advisory that the vulnerability may be exploited pre-authentication, with validation of the certificate occurring after the vulnerable code path is reached, and a new analysis from watchTowr Labs described the issue as having characteristics ransomware gangs typically look for. The vulnerability has been addressed in multiple versions, including 2025.1-1, 12.11.4, 12.3.1_Update3, and 12.5.13, while 11.x has reached end-of-life.

A separate note in the article mentions related activity around a DoS vulnerability in Progress Telerik UI for AJAX (CVE-2025-3600) as a reminder of ongoing remediations in the ecosystem.