WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability (CWE-416) in the LDAP authentication mechanism for Mobile User VPN with IKEv2. This flaw allows a remote unauthenticated attacker to exploit the vulnerability to execute arbitrary code within the iked process context on affected Firebox devices that use an external LDAP authentication server. The vulnerability affects versions 11.10.2 and 2025.1 of Fireware OS. The CVSS 4.0 base score is 9.2, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary code on the affected device, potentially compromising the Firebox's security and control. This could lead to full compromise of the VPN authentication process and unauthorized access or disruption of network services relying on the Firebox.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by WatchGuard at this time. Users should monitor WatchGuard advisories closely and apply any forthcoming updates promptly. Until a patch is available, consider disabling Mobile User VPN with IKEv2 LDAP authentication if feasible or applying compensating controls as recommended by WatchGuard.