All vulnerabilities
CVE-2025-9242

WatchGuard Firebox Out-of-Bounds Write Vulnerability

WatchGuard FireboxNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationExploited in the wildAdded to KEV 12 Nov 2025CISA KEV
Exploit odds (EPSS)91.8%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in12.11.4Also 2025.1.1, 12.3.1+722811 and 1 moreCVE List
Federal deadline3 Dec 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Sep 2025, 07:29 UTCPublishedCVE List
  2. 12 Nov 2025Added to CISA KEVCISA KEV

Description

WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.

Text from CVE List

Affected versions 5

  • Fireware OSaffected: 11.0 through 11.12.4+541730CVE List
  • Fireware OSaffected: 12.0 before 12.11.4CVE List
  • Fireware OSaffected: 2025.0 before 2025.1.1CVE List
  • Fireware OSaffected: 12.0 before 12.3.1+722811CVE List
  • Fireware OSaffected: 12.0 before 12.5.13CVE List

References 5