CVE-2025-9242

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.922 · 100 %ileexploit · PoCDEEUNLRUUS
grimoire priorityP0 · Act now
Exploitable?
Yes · in the wild
CISA KEV · 1 exploit · PoC
Likely / severe?
92.2% (100th) EPSS
CVSS 9.8 · critical
Is it mine?
20 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-11-12remediate by 2025-12-03

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-26

WatchGuard Firebox Out-of-Bounds Write Vulnerability

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

01

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary
v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USCWE-787USCWE-787US
04

exploits (1)

Public proof-of-concept and weaponised exploit code.

05

affected products (20)

Products and version ranges known to be affected.

06

advisories (2)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0296Kwetsbaarheid verholpen in WatchGuard Fireware OSNL2025-09-19csaf · ncsc_nlNL

    Onderzoekers hebben data gepubliceerd over waar de kwetsbaarheid zich zeer waarschijnlijk bevind, het is de verwachting dat naar aanleiding van deze publicatie er op korte termijn Proof of Concept code beschikbaar komt, waarmee uitbuiting van de kwetsbaarheid zeer waarschijnlijk wordt.

  • WID-SEC-W-2025-2071WatchGuard Firebox: Schwachstelle ermöglicht CodeausführungDeutsch2025-09-16csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WatchGuard Firebox ausnutzen, um beliebigen Programmcode auszuführen.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlnvdNVDCVE.orgMITRE
published 2025-09-17modified 2026-08-10
09

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan