CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Critical Remote Code Execution Vulnerability in WatchGuard Firebox Firewalls

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

WatchGuard has patched a critical remote code execution vulnerability in Firebox firewalls. The flaw, CVE-2025-9242, is an out-of-bounds write issue affecting devices running specific versions of Fireware OS. Exploitation can lead to remote code execution on vulnerable devices configured to use IKEv2 VPN. The vulnerability impacts Firebox firewalls running Fireware OS 11.x, 12.x, and 2025.1. The flaw is exploitable if the firewalls are configured to use IKEv2 VPN, and devices may remain vulnerable even if the configurations have been deleted. WatchGuard has provided patches and a temporary workaround for affected systems. The vulnerability is not yet exploited in the wild, but administrators are advised to update their devices promptly.

Timeline

  1. 18.09.2025 11:23 📰 1 articles · ⏱ 1d ago

    Critical Remote Code Execution Vulnerability in WatchGuard Firebox Firewalls

    WatchGuard has released security updates to address a critical remote code execution vulnerability (CVE-2025-9242) in Firebox firewalls. The flaw affects devices running Fireware OS 11.x, 12.x, and 2025.1 and is exploitable through IKEv2 VPN configurations. Patches are available, and a temporary workaround is provided for affected systems. The vulnerability is not yet exploited in the wild, but administrators are advised to update their devices promptly.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Critical deserialization vulnerability in Fortra GoAnywhere MFT

Fortra disclosed a critical deserialization vulnerability in GoAnywhere Managed File Transfer (MFT) software (CVE-2025-10035). This flaw, with a CVSS score of 10.0, allows arbitrary command execution through a forged license response signature. The vulnerability affects systems accessible over the internet and was patched in versions 7.8.4 and 7.6.3. Fortra has not confirmed exploitation in the wild, but similar vulnerabilities in the same product were previously exploited by ransomware actors. Users are advised to update to the patched versions immediately or restrict public access to the GoAnywhere Admin Console. Fortra discovered the vulnerability during a security check on September 11, 2025. The vulnerability was identified in the License Servlet of GoAnywhere MFT. Over 470 GoAnywhere MFT instances are being monitored by the Shadowserver Foundation.

Open in new tab