DaystoPatch

WatchGuardExploited incident

WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE)

CVE-2025-9242Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 12 Nov 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-9242 (CNA: WatchGuard)CuratedQuote verified

    "assignerShortName":"WatchGuard","dateReserved":"2025-08-20T11:08:20.724Z","datePublished":"2025-09-17T07:29:23.738Z"

    Coordinated disclosure with fixes; exploitation followed after public technical analysis (KEV 2025-11-12).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:13289c205f0fc165…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2025-9242ClaimedQuote verified17 Sep 2025, 07:29 UTC

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:13289c205f0fc165…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet17 Sep 2025, 09:01 UTC

    WatchGuard Fireware OS faces CRITICAL vulnerability (CVE-2025-9242, CVSS 9.3) enabling remote code execution via VPN w/ dynamic peers. Restrict access, monitor traffic, act fast! https://radar.offseq.com/threat/cve-2025-9242-c

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet18 Sep 2025, 08:41 UTC

    hackers roam free—are you ready to patch up? https:// thedefendopsdiaries.com/critic al-watchguard-firebox-vulnerability-cve-2025-9242-puts-thousands-at-risk/ # watchguard # firebox # cve20259242 # firewallvulnerability # networksecurity

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-9242)ClaimedQuote verified12 Nov 2025

    WatchGuard Firebox Out-of-Bounds Write Vulnerability

    Added to CISA's KEV catalog on 2025-11-12.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-9242 (CNA: WatchGuard)CuratedQuote verified

    "datePublished":"2025-09-17T07:29:23.738Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:13289c205f0fc165…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    WatchGuard PSIRT CVE-2025-9242CuratedQuote verified17 Sep 2025

    Published 2025-09-17

    The original WGSA-2025-00015 page (Wayback 20250918105826) also says 'Published Date 2025-09-17'.

    Source
    WatchGuard PSIRT CVE-2025-9242 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a1d369181c5075c8…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    WatchGuard PSIRT WGSA-2025-00015 (Wayback snapshot 2025-09-18 10:58 UTC)CuratedQuote verified

    Workaround Available True

    Workaround (secure branch office VPNs to static peers per WatchGuard KB) in the first-day advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b997fa45723f93c…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    WatchGuard PSIRT CVE-2025-9242CuratedQuote verified

    Fireware OS 2025.1.1, Fireware OS 12.11.4, Fireware OS 12.5.13, Fireware OS 12.3.1+722811

    The first-day advisory (Wayback 20250918105826) lists the same resolved versions with status 'Resolved'.

    Source
    WatchGuard PSIRT CVE-2025-9242 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a1d369181c5075c8…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    WatchGuard PSIRT CVE-2025-9242CuratedQuote verified

    Fireware OS 2025.1.1, Fireware OS 12.11.4, Fireware OS 12.5.13, Fireware OS 12.3.1+722811

    All supported branches fixed at publication; Fireware 11.x is end of life and not counted.

    Source
    WatchGuard PSIRT CVE-2025-9242 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a1d369181c5075c8…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • WatchGuard Firebox (Fireware OS)
How we built this timeline

Coordinated disclosure 17 Sep 2025 with fixes for all supported branches. The current page now states 'We have evidence that suggests this vulnerability is under active exploitation.' (added after first publication; the advisory was last updated 10 Aug 2026). watchTowr published a technical analysis and proof of concept in October 2025 (not fetched);

KEV 12 Nov 2025. The same iked component was hit again by CVE-2025-14733 in December 2025.

The CVE record time (07:29Z) is the only minute-level timestamp; the advisory shows only dates.

Related

WatchGuard report card