Remote Code Execution Vulnerability in WatchGuard Firebox

Historical catalog analysis: CISA added this entry on November 12, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-9242 is an out-of-bounds write vulnerability (CWE-787) located within the OS iked process of WatchGuard Firebox devices. This flaw could potentially allow a remote, unauthenticated attacker to execute arbitrary code on the affected system.

Exposure and applicability

WatchGuard Firebox devices are frequently utilized by U.S. healthcare providers, medical practices, and business associates to establish secure network perimeters and manage encrypted traffic. Because this vulnerability affects the iked process—typically associated with Internet Key Exchange (IKE) for VPN services—devices exposing these services to the public internet may be at higher risk. An attacker gaining arbitrary code execution on a perimeter firewall could potentially bypass security controls, threatening the confidentiality of electronic Protected Health Information (ePHI) and the overall operational resilience of clinical environments.

Remediation priorities

Our analysis suggests that healthcare IT and security leaders prioritize the following actions to reduce exposure:

1. Identify Affected Assets: Inventory all perimeter devices to determine which WatchGuard Firebox units are in use and verify their current firmware versions against vendor advisories.
2. Apply Vendor Mitigations: Prioritize the application of patches or mitigations as specified by WatchGuard instructions. This is the primary method for addressing the underlying out-of-bounds write flaw.
3. Review Perimeter Exposure: Evaluate whether the iked process or associated VPN services are exposed to untrusted networks and determine if access can be restricted to known, authorized IP ranges while patching is underway.

How to validate remediation

To verify that exposure has been reduced, administrators should use the following methods:
* Version Verification: Confirm through the device management console that the firmware version matches or exceeds the version recommended in the vendor’s security advisory.
* Configuration Audit: Review firewall rules and service configurations to ensure that only necessary ports are open and that mitigations suggested by the vendor have been successfully applied.

It is important to note that a version check confirms the update was applied, but it does not guarantee that all potential attack vectors are eliminated.

Limits and open questions

While CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, the status of its use in known ransomware campaigns remains unknown. Additionally, the specific range of affected Firebox versions is not detailed in the summary; organizations must refer directly to WatchGuard’s PSIRT advisory for precise versioning. Applying mitigations could reduce the likelihood of exploitation, but residual risk may remain if other configuration weaknesses exist on the network perimeter.

Source and editorial note

CVE-2025-9242: WatchGuard Firebox Out-of-Bounds Write Vulnerability · Source date: November 12, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 15, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 26, 2026 at 02:48 UTC.

Request a healthcare security assessment