A critical WatchGuard Fireware flaw could allow unauthenticated code execution

A critical vulnerability in WatchGuard Fireware, tracked as CVE-2025-9242, could allow unauthenticated code execution, according to the report. The flaw is an out-of-bounds write in the iked process that affects Fireware OS versions 11.10.2–11.12.4_Update1, 12.0–12.11.3, and 2025.1, with a CVSS score of 9.3. An unauthenticated attacker can exploit the vulnerability to run arbitrary code via the IKEv2 VPN service exposed on Firebox devices, making pre-auth exploitation possible.

The advisory notes impact on both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer, and that devices may remain vulnerable even after deleting those VPN configurations if a static gateway remains. WatchGuard’s advisory is quoted, and the issue is linked to a 520-byte stack buffer overflow during IKE_SA_AUTH, enabling overflow before certificate validation, according to watchTowr researchers. The article urges customers to patch urgently, emphasising the high-risk exposure of perimeter devices and remote-code-execution potential.