Follow us on Google News
WatchGuard has released security updates to address a critical vulnerability, CVE-2025-9242, in its Firebox firewall line. The company warns that the flaw — an out-of-bounds write in the Fireware iked process — could allow a remote, unauthenticated attacker to execute arbitrary code, effectively compromising protected networks. With a severity score of 9.3, administrators are being urged to apply patches immediately.
https://the420.in/futurecrime-future-crime-summit-2026-new-delhi-fcrf-tech-crime-law-enforcement-cybersecurity-dfir-conference/#
What the flaw does
The bug occurs when the IKEv2 VPN implementation mishandles memory writes, permitting data to be written outside intended bounds. In practical terms, an attacker who can reach the vulnerable service may trigger code execution without valid credentials. WatchGuard cautions that the vulnerability can persist even if IKEv2 settings were removed in the past, making remediation urgent for any organization that ever enabled that VPN type.
Affected products and versions
WatchGuard lists multiple Firebox models and Fireware OS releases as impacted. Affected releases include Fireware OS 11.10.2 up through 11.12.4_Update1, 12.0 through 12.11.3, and the 2025.1 branch. Models noted include T15 and T35 running Fireware 12.5.x, plus numerous T, M and Firebox Cloud series devices on 12.x and 2025.1.x images. Security teams should consult WatchGuard’s advisory for a full inventory tailored to their fleet.
Patch, workarounds and immediate steps
WatchGuard has published fixes in updates such as 12.3.1_Update3, 12.5.13, 12.11.4 and 2025.1.1. Administrators should verify device firmware and install the appropriate patch without delay. Where immediate updating is not possible, WatchGuard recommends mitigating exposure by restricting access to VPN services at the network edge and applying filtering rules to limit unauthenticated traffic to the iked service.
Expert views and risk assessment
Security researchers called the vulnerability highly dangerous. David Matalon of Venn said it “underlines how much trust organisations place in perimeter defences,” urging layered controls. Mayuresh Dani of Qualys warned that the flaw’s persistence makes patched inventories essential, while Frankie Sclafani of Deepwatch likened the CVSS 9.3 rating to a “five-alarm fire.” No public exploit has been confirmed, but the combination of high severity and firewall exposure means defenders must assume active targeting is likely now.
