CVE-2025-9242: WatchGuard Firebox Out‑of‑Bounds Write Vulnerability Enables Remote Code Execution
What It Is – WatchGuard Firebox appliances contain an out‑of‑bounds write flaw in the iked process of the operating system. The defect can be triggered by a remote, unauthenticated attacker to execute arbitrary code on the device.
Exploitability – The vulnerability is network‑reachable, requires no credentials, and has a CVSS v3.1 base score of 9.8 (Critical). Public proof‑of‑concept code has been released, indicating active exploitation is feasible.
Affected Products – All WatchGuard Firebox models running the vulnerable OS version (specific versions listed in the vendor advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability scanning and rapid patch deployment as evidence of a mature patch‑management control.
- Provides a concrete test case for the “Vulnerability Management” control objective that maps to many frameworks (e.g., NIST CSF 2.0 Identify‑Detect).
- Failure to remediate leaves a gap in the audit trail, weakening the organization’s defensible posture when auditors or customers request proof of risk mitigation.
Recommended Actions
- Verify the current Firebox firmware version against the vendor’s advisory and apply the supplied patch immediately.
- Update your vulnerability‑management process to include automated detection of out‑of‑bounds write flaws in network devices.
- Capture patch‑deployment evidence in a centralized Trust Center to support audit readiness and continuous control monitoring.
Source: CISA KEV – CVE‑2025‑9242