CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
Source The Hacker News
Exploited in the wild · KEV due 3 Dec 2025 : apply the vendor's fix or mitigations to affected systems now.
Data as of 11/20/2025, 02:24:05 UTC
- KEV deadline
- 12/03/2025 US federal agencies must patch by this date; a sensible deadline for everyone else.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 17 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wild: evidence found.
Listed in CISA KEV 56 days after disclosure
Observed by OffSeq Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by WatchGuard
, 28 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 6 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 56 days after disclosure
KEV remediation due
US federal deadline
, 77 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Immediately identify all WatchGuard Firebox devices running vulnerable Fireware OS versions within the network using asset management and vulnerability scanning tools. 2. Apply the latest patches provided by WatchGuard for Fireware OS versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1 without delay, prioritizing devices exposed to untrusted networks. 3. Restrict access to Firebox management interfaces and VPN endpoints by implementing strict firewall rules and network segmentation to limit exposure. 4. Monitor network traffic for anomalous IKE handshake attempts, especially malformed or unusually sized identification buffers, using intrusion detection/prevention systems (IDS/IPS) and network behavior analytics. 5. Employ multi-factor authentication and strong certificate validation policies to reduce risk from other attack vectors, even though this vulnerability bypasses initial certificate checks. 6. Conduct regular security audits and penetration tests focusing on VPN and firewall infrastructure to detect potential exploitation. 7. Maintain up-to-date threat intelligence feeds and subscribe to CISA alerts to stay informed of any new developments or exploit techniques related to this vulnerability. 8. Develop and test incident response plans specifically addressing potential Firebox compromise scenarios to ensure rapid containment and recovery.
Description
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-9242 (CVSS score: 9.3), an out-of-bounds write vulnerability affecting Fireware OS 11.10.2 up to and including
Impact
For European organizations, this vulnerability represents a significant threat to network security and operational continuity. WatchGuard Firebox devices are commonly used in enterprise and government environments for firewall protection and VPN connectivity. Successful exploitation could allow attackers to bypass authentication entirely, execute arbitrary code, and gain control over the affected devices. This could lead to interception of sensitive communications, unauthorized access to internal networks, data exfiltration, and disruption of critical services. Given the large number of vulnerable devices in Italy, the UK, and Germany, organizations in these countries face heightened risk. The ability to exploit the vulnerability remotely and without user interaction increases the attack surface and potential impact. Compromise of Firebox devices could also facilitate further attacks within networks, including ransomware deployment or espionage. The critical nature of the flaw and the active exploitation evidence make it imperative for European organizations to act swiftly to avoid operational and reputational damage.