CISA Flags Critical Watch Guard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
Summary: CISA added CVE-2025-9242, a CVSS 9.3 out-of-bounds write in the WatchGuard Fireware OS iked process, to its Known Exploited Vulnerabilities catalog on evidence of active exploitation; WatchGuard patched it in September. The flaw stems from a missing length check on an identification buffer in the IKE handshake, and certificate validation runs after the vulnerable code, making the path reachable pre-authentication; Shadowserver counted 54,300 vulnerable Firebox instances as of November 12, 2025, down from 75,955 on October 19, with about 18,500 in the U.S.
Key Takeaway: A remote unauthenticated attacker can reach this code before any credential check, and roughly 54,300 Fireboxes were still exposed on November 12 - with FCEB agencies given until December 3, 2025 to patch.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-12480CVE-2025-62215CVE-2025-9242
- Related
- CVE-2025-9242: Watch Guard Firebox Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025CVE-2025-62215: Microsoft Windows Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025CVE-2025-12480: Gladinet Triofox Improper Access Control Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025