VulnSocial

CVE-2025-9242Disclosure(watchguard / firebox_m270)

LOWCVSS 9.8 · CRITICALCISA KEV

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

watchguard CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-12-03. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • firebox_m270
  • firebox_m290
  • firebox_m295
  • firebox_m370

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-09); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
watchguard
Products
firebox_m270firebox_m290firebox_m295firebox_m370firebox_m390firebox_m395firebox_m440firebox_m4600firebox_m470firebox_m4800

2 versions affected across 39 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-09: 1Mentions · 2026-07-24: 1PoC Mentioned / Linked · 2026-07-24: 1Technical Details · 2026-03-09: 103-0907-24
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-03-091
Disclosure1
2026-07-241
PoC1
Full discourse2 posts
  • Clandestine@akaclandestine
    PoC

    https://github.com/UnusualGiraffe/Mass-Scanner-CVE-2025-9242

    Post summary

    The linked GitHub repository appears to host a scanner tool for CVE-2025-9242, indicating the availability of a Proof of Concept. No evidence of active exploitation, patches, or detailed technical information is presented.

    04016122.4K
    64.3K followersView on X
  • Security Aid@SecurityAid
    Disclosure

    Critical WatchGuard Fireware OS Flaw Enables Remote Code Execution A critical out-of-bounds write flaw (CVE-2025-9242) in WatchGuard Fireware OS could allow remote code executionA critical out-of-bounds write flaw (CVE-2025-9242) in WatchGuard Fireware OS could allow remote c... https://t.co/OfbYYOvgxF

    Post summary

    A critical out‑of‑bounds write flaw (CVE‑2025‑9242) in WatchGuard Fireware OS could allow remote code execution; otherwise no PoC, exploit code, active exploitation, patch, or false positive information is provided.

    0000077
    124 followersView on X
CPE platform detail40 entries

40 of 40 entries

PartVendorProductVersionTarget SWTarget HW
HWwatchguardfirebox_m270---
HWwatchguardfirebox_m290---
HWwatchguardfirebox_m295---
HWwatchguardfirebox_m370---
HWwatchguardfirebox_m390---
HWwatchguardfirebox_m395---
HWwatchguardfirebox_m440---
HWwatchguardfirebox_m4600---
HWwatchguardfirebox_m470---
HWwatchguardfirebox_m4800---
HWwatchguardfirebox_m495---
HWwatchguardfirebox_m5600---
HWwatchguardfirebox_m570---
HWwatchguardfirebox_m5800---
HWwatchguardfirebox_m590---
HWwatchguardfirebox_m595---
HWwatchguardfirebox_m670---
HWwatchguardfirebox_m690---
HWwatchguardfirebox_m695---
HWwatchguardfirebox_nv5---
HWwatchguardfirebox_t115-w---
HWwatchguardfirebox_t125---
HWwatchguardfirebox_t125-w---
HWwatchguardfirebox_t145---
HWwatchguardfirebox_t145-w---
HWwatchguardfirebox_t15---
HWwatchguardfirebox_t185---
HWwatchguardfirebox_t20---
HWwatchguardfirebox_t25---
HWwatchguardfirebox_t35---
HWwatchguardfirebox_t40---
HWwatchguardfirebox_t45---
HWwatchguardfirebox_t55---
HWwatchguardfirebox_t70---
HWwatchguardfirebox_t80---
HWwatchguardfirebox_t85---
HWwatchguardfireboxcloud---
HWwatchguardfireboxv---
OSwatchguardfireware---
OSwatchguardfireware2025.1--

Explore more

Back to dashboardwatchguard CVEsfirebox_m270 vulnerabilities