One Packet to the Edge: CVE-2025-9242 in WatchGuard Firebox

A single crafted VPN packet can hand an unauthenticated attacker code execution on a WatchGuard Firebox, the firewall that sits at the edge of tens of thousands of small offices, branch sites, and remote facilities. The flaw has been actively exploited and on CISA's KEV catalog since late 2025. What put it back on our radar today is a fresh public exploit: a proof-of-concept plus a mass scanner, published to GitHub this weekend.

Why we are covering it now: our watch caught it through the independent proof-of-concept gate, not a new KEV listing. A public PoC and internet-wide scanner for an already-exploited edge appliance is the kind of event that widens the pool of who can attack it.

What Firebox is, and where it sits

WatchGuard is a network-security vendor whose Firebox line is one of the more common firewall and unified-threat-management appliances in the small and mid-market. WatchGuard says it works with more than 17,000 resellers and service providers to protect the networks of over 250,000 small and mid-sized companies. In practice that means Fireboxes are deployed in places that rarely have a dedicated security team: a regional office, a clinic, a municipal facility, a remote pump station, a small manufacturer. The appliance is the edge. It is the firewall, and it is very often the VPN concentrator that lets remote workers and other sites reach the internal network.

That last role is the one that matters here. Firebox terminates both Mobile User VPN and Branch Office VPN (BOVPN) tunnels, and the negotiation for those tunnels is handled by the IKE daemon, iked. The IKE service listens on the internet-facing side of the box, on UDP 500 and UDP 4500, because that is where remote peers connect from. A flaw in that service is reachable by anyone who can send a packet to the appliance, which for an internet-connected firewall is the entire internet. Compromise the box that terminates the VPN and you are not on the perimeter anymore, you are inside the tunnel it was protecting.

How the flaw works

CVE-2025-9242 is an out-of-bounds write (CWE-787) in the iked process of Fireware OS. IKEv2 is the protocol that two VPN endpoints use to authenticate and agree on keys before a tunnel comes up. That negotiation happens over a series of UDP messages, and each message is a structured set of payloads that the receiving side has to parse before either peer has proven anything. Parsing attacker-controlled input before authentication is exactly the kind of place where a memory-safety bug becomes remotely exploitable.

In the vulnerable versions, a specially crafted IKEv2 exchange causes iked to write past the bounds of a buffer. An out-of-bounds write corrupts adjacent memory, and on a service that handles this parsing before authentication, an attacker who controls the contents and layout of that write can steer it toward controlling execution on the device. The result, per WatchGuard and NVD, is that a remote, unauthenticated attacker can execute arbitrary code. There is no password step and no user interaction, and the attack complexity is low. The one thing the attacker needs is a Firebox that is configured to speak IKEv2 for VPN and is reachable from where they are sending packets.

The exposure is gated by configuration rather than by any exotic prerequisite. A Firebox that does not use IKEv2 VPN, or whose IKE service is not reachable from the attacker's vantage point, is not exploitable through this path. But VPN is the reason many of these appliances exist, so the vulnerable configuration is a common one, and the IKE service is internet-facing by design.

Why it is back on our radar today

The vulnerability itself is not new. WatchGuard published the advisory and fixed builds in September 2025, a proof-of-concept was made public in October 2025, and within a month Shadowserver's internet-wide scans found more than 75,000 Fireboxes still exposed, most of them in North America and Europe. CISA subsequently added CVE-2025-9242 to the Known Exploited Vulnerabilities catalog and directed federal agencies to remediate, confirming exploitation in the wild.

What changed this week is availability. Our daily watch tracks two independent signals, the CISA KEV catalog and freshly published proof-of-concept code on GitHub. This item did not come from a new KEV entry. It came from the PoC gate: on 2026-07-26 a public repository appeared that pairs a working exploit for CVE-2025-9242 with a mass scanner built to sweep the internet for vulnerable Fireboxes, following a detection-only scanner from the same author two days earlier. That combination lowers the effort required to find and hit exposed devices, and a still-large exposed population makes that a meaningful shift even for a months-old flaw.

A patched, actively exploited flaw does not get safer with age when a fresh exploit and scanner make it easier to weaponize.

It is also worth knowing the shape of the wider story, because it argues for treating this device class as a recurring target rather than a one-time fix. In December 2025 WatchGuard patched a near-identical iked out-of-bounds write, CVE-2025-14733, which CISA added to its KEV catalog the following day and for which Shadowserver counted well over 100,000 exposed instances. Two closely related critical VPN-parsing bugs in the same daemon within a few months is a pattern, and it means the right response is durable hardening of the IKE attack surface, not just a single patch.

The real-world risk

Code execution on a firewall is close to a worst case for a single device, because the firewall is trusted by everything around it. An attacker who lands on a Firebox can establish a persistent shell, read the configuration, and harvest the secrets stored on the appliance, including VPN and authentication material. Because the box terminates the VPN, they are positioned to intercept or decrypt the traffic that passes through it and to pivot into the internal network the tunnel was built to reach. And because it is a security appliance rather than a workstation, defenders are less likely to have endpoint monitoring on it, so dwell time can be long.

For operational and critical-infrastructure environments, we want to be precise and honest. WatchGuard Firebox is an enterprise and small-business network-security product, not an industrial control system, and CVE-2025-9242 is not an ICS vulnerability. Its relevance to OT and CI is indirect but real, and it comes from where these appliances are deployed. Fireboxes sit at the edge of exactly the kind of small, distributed sites that make up much of real-world critical infrastructure: remote utility sites, water and wastewater facilities, small manufacturers, clinics, municipal offices. In those places the Firebox is frequently the device that terminates the site-to-site or remote-user VPN into the operational network, which makes it the boundary between the internet and the systems that run physical processes. A compromised edge firewall is a compromise of that boundary. CISA does not list known ransomware use for this CVE, and we have seen nothing tying it to ransomware, so we will not imply one.

What the exposed population looks like

We pulled a quick Shodan read to size up the exposed footprint. A search for WatchGuard's management fingerprints returns a few thousand internet-facing devices, concentrated in the United States, Italy, the United Kingdom, Canada, and France, which lines up with Shadowserver's finding that most exposed Fireboxes sit in North America and Europe. The surfaces Shodan indexes here are the management and monitoring planes: the WatchGuard management port (4118) appears on roughly 1,500 hosts, SNMP (161) on several hundred more, and the HTTPS management interface on a smaller set.

What stands out is the age of what is exposed. Many of those management interfaces still present self-signed WatchGuard "Firebox EDGE" certificates signed with MD5 and valid from 2006, and they still negotiate SSLv3 and TLS 1.0, protocols that have been deprecated for years. That is the signature of appliances that have not been meaningfully maintained in a long time, which is exactly the population least likely to have taken the September 2025 Fireware fix.

What our sensors see

We run a fleet of honeypots and edge decoys, so we read this in the context of our own telemetry. Unauthenticated scanning and probing of internet-facing VPN and firewall services is a constant on our sensors, and IKE and ISAKMP traffic on UDP 500 and 4500, along with fingerprinting of VPN and firewall management surfaces, is part of that steady background. A public mass scanner for a specific appliance, like the one published this week, is the kind of tool that turns that background noise into targeted sweeps, and exposed edge devices tend to draw automated attention within hours of coming online.

How to fix and mitigate it

• Patch Fireware OS now. Update to a fixed release: 2025.1.1, 12.11.4, or 12.5.13 depending on your model and branch. The 11.x family is end-of-life and has no fix, so devices on 11.x should be upgraded to a supported, patched release rather than left as they are.
• If you cannot patch immediately, disable IKEv2 VPN. Where IKEv2 Mobile User or Branch Office VPN is not operationally required, disabling it removes the vulnerable attack surface. WatchGuard has published guidance for temporarily removing the exposed configuration.
• Restrict who can reach the IKE service. Limit access to UDP 500 and 4500 to known peer addresses where the deployment allows it, so an arbitrary internet host cannot negotiate with iked.
• Do not expose management interfaces. Keep appliance management off the public internet and on a restricted administration network, and confirm remote management is not reachable from untrusted networks.
• Hunt for compromise, even after patching. On any Firebox that was internet-reachable and running IKEv2, rotate locally stored secrets and VPN credentials, review configuration and administrator accounts for unexpected changes, and look for gaps or anomalies in logging. A patched device that was exposed during the exploitation window should be treated as potentially touched until reviewed.

Reference