WatchGuard VPN Flaw Allows Remote Attackers to Execute Arbitrary Code

A critical security vulnerability has been discovered in WatchGuard Firebox appliances that could allow remote attackers to execute arbitrary code without authentication, identified as CVE-2025-9242 and affecting the IKEv2 VPN service with a CVSS 4.0 score of 9.3. According to watchTowr Labs, the flaw is a stack-based buffer overflow in the iked process, triggered by oversized identification data during IKEv2 authentication and exploitable via specially crafted IKEv2 packets on UDP port 500.

Exploitation can occur remotely and without any authentication, with researchers demonstrating a two-stage exploit chain that uses return-oriented programming to achieve remote code execution with root privileges. The issue affects a wide range of Fireware OS versions, including 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1, and WatchGuard has issued patches or workarounds, urging immediate upgrades to Fireware OS version 2025.1.1 or alternatives for various models.

The vulnerability was credited to security researcher btaol, and WatchGuard reports it protects over 250,000 organisations worldwide with more than 10 million endpoints.