Earlier this week, CISA added a serious WatchGuard Fireware vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, a move that reflects the real risk this flaw poses to organizations worldwide.
The vulnerability, CVE-2025-9242, is an out-of-bounds write affecting the Firebox OS. A remote attacker could exploit it to run arbitrary code, all without needing to authenticate. It’s a reminder of how subtle coding oversights, like a missing length check during the IKE handshake, can create a gateway for attackers.
Security researchers at WatchTowr Labs first identified the issue, pointing out that even though certificate validation happens later in the process, the vulnerable code executes first, leaving systems exposed. It’s one of those “pre-authentication” vulnerabilities that keep cybersecurity teams awake at night.
The scope is significant. According to the Shadowserver Foundation, more than 54,000 Firebox devices remain exposed, including about 18,500 in the U.S. alone. Italy, the U.K., Germany, and Canada round out the top five most affected countries. For federal agencies, WatchGuard’s patches are mandatory by December 3, 2025.
This isn’t the only vulnerability CISA has flagged recently. The catalog also now includes a Windows kernel flaw (CVE-2025-62215) and a critical access control issue in Gladinet Triofox (CVE-2025-12480), which Google’s Mandiant team has linked to threat actor UNC6485.
If your organization uses Firebox devices, now is the moment to act. Apply the patches, double-check network monitoring, and verify system integrity. In today’s landscape, vigilance isn’t optional, it’s a necessity.
Source: The Hacker News
