Researchers Uncover Watch Guard VPN Bug That Could Let Attackers Take Over Devices
Summary: Researchers disclosed a patched critical out-of-bounds write flaw in WatchGuard Fireware OS, tracked as CVE-2025-9242 with a CVSS score of 9.3, that allows a remote unauthenticated attacker to execute arbitrary code in the iked process. The bug stems from a missing length check in the ike2_ProcessPayload_CERT function, which copies a client identification into a 520-byte stack buffer before certificate validation runs, making the vulnerable path reachable pre-authentication during the IKE_SA_AUTH phase.
Key Takeaway: The Shadowserver Foundation estimates roughly 73,000 WatchGuard instances were still susceptible as of October 20, 2025, with about 24,000 in the U.S., and watchTowr describes the flaw as having the traits ransomware gangs look for: an internet-exposed service, no authentication needed, and code execution on a perimeter appliance.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-3600CVE-2025-36604CVE-2025-9242
- Related
- CVE-2025-9242: Watch Guard Firebox Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Nov 12, 2025