What Is CVE-2025-9242?
CVE-2025-9242 is a critical vulnerability in the WatchGuard Firebox Fireware OS identified in advisory WGSA-2025-00015. 
- It’s an Out-of-Bounds Write flaw in the iked process, which is part of WatchGuard’s implementation of IKEv2 (Internet Key Exchange version 2). 
- Because of this vulnerability, a remote unauthenticated attacker could potentially execute arbitrary code on a Firebox device. 
- The vulnerability affects both mobile user VPNs with IKEv2 and branch office VPNs using IKEv2 when those VPNs are configured with a dynamic gateway peer. 
Which Devices and Versions Are Affected
The issue spans a broad range of Firebox devices and Fireware OS versions. Some of the affected versions include:
- Fireware OS 11.10.2 up to 11.12.4_Update1 
- Fireware OS 12.0 up through 12.11.3 
- OS version 2025.1 
It also affects multiple hardware models: Firebox T15, T35; various “12.x” T-series, Firebox Cloud, NV5, V models etc.
Severity & Impact
- The CVSS score is 9.3 / Critical. 
- Because it allows a remote unauthenticated attacker to write out of bounds and potentially execute arbitrary code, the risk is high. 
- Even if certain vulnerable configurations have been deleted (e.g. dynamic gateway peer VPNs), Fireboxes may still remain vulnerable if a branch-office VPN to a static gateway peer is still configured. 
What Should You Do: Mitigations & Remediation
1. Patch as Soon as Possible
WatchGuard has released fixed versions of Fireware OS that resolve this vulnerability. Some fixed versions include:
- 2025.1 → 2025.1.1 
- 12.x → 12.11.4 
- For Firebox T-series and other models, other corresponding patches have also been released. 
2. Workaround (if you can’t immediately patch)
If you can’t immediately upgrade:
- Limit or disable branch office VPNs using IKEv2 with dynamic gateway peers.
- Follow WatchGuard’s guidance for “Secure Access to Branch Office VPNs that Use IPSec and IKEv2” until the patch is applied. 
3. Audit Configurations
- Verify whether your Firebox devices have been configured with mobile user VPN with IKEv2 or branch office VPNs with IKEv2 and dynamic gateway peers.
- Even if those configurations were removed in the past, check if there are static gateway peer configs that might still leave a device exposed.
4. Review Security Posture
- Ensure VPN endpoints are hardened and monitored.
- Use network segmentation and limit access only to necessary systems.
- Apply least privilege principles: only allow what is necessary for the VPN connections.
Why This Matters
VPNs are a critical piece of many organizations’ infrastructure. A vulnerability like CVE-2025-9242 has potential to grant access to internal network resources if a Firebox is compromised. The broad set of affected versions and devices increases the urgency.
Conclusion
CVE-2025-9242 is a serious vulnerability in WatchGuard Firebox devices. If you manage any Firebox appliance:
- Check if your version is affected
- Patch to a resolved version immediately
- If unable to patch right away, apply the workaround
- Audit your VPN configurations and access controls
Keeping your firewall and VPN infrastructure up-to-date is essential for maintaining overall network security.