WatchGuard Firebox iked Process Out-of-Bounds Write (CVE-2025-9242)

Historical catalog analysis: CISA added this entry on November 12, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-9242 is an out-of-bounds write vulnerability (CWE-787) located within the iked process of the WatchGuard Firebox operating system. This flaw could allow a remote, unauthenticated attacker to execute arbitrary code on the affected device.

Exposure and applicability

This vulnerability affects organizations utilizing WatchGuard Firebox devices where the iked process is active and exposed to network traffic. Because the vulnerability allows for unauthenticated access, any asset running the susceptible version of the OS that is reachable by a potential attacker is at risk. Security leaders should prioritize assets positioned at the network perimeter, as these are most likely to be targeted.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be treated as a high priority. Our analysis suggests the following prioritization:

1. Immediate Patching: Apply vendor-supplied mitigations and updates specifically targeting the iked process.
2. Cloud Service Review: For organizations utilizing Firebox via cloud services, follow applicable BOD 22-01 guidance to ensure the service provider has addressed the exposure.
3. Decommissioning: If a mitigation or patch is unavailable for a specific legacy hardware model, the device should be discontinued to eliminate the attack surface.

How to validate remediation

Verification must go beyond a simple version check. While updating the firmware is the primary corrective action, defenders should verify that the iked process is operating under the patched version and that the vulnerability is no longer exploitable in their specific environment.

Validation evidence should include:
* Confirmation of the installed OS version against vendor-provided fixed versions.
* Verification that any compensating controls (such as ACLs restricting access to the iked process) are active if patching is delayed.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has established a remediation deadline of December 3, 2025, for federal agencies, non-federal organizations must determine their own risk tolerance and timelines based on their specific exposure. There is residual risk if the vendor’s mitigation does not fully address all paths to the out-of-bounds write or if configuration errors leave the process exposed despite patching.

Source and editorial note

CVE-2025-9242: WatchGuard Firebox Out-of-Bounds Write Vulnerability · Source date: November 12, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 15, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 29, 2026 at 00:16 UTC.

Request a Vulnerability Assessment