CVE-2025-9242

CVE-2025-9242 is an Out-of-bounds Write vulnerability in WatchGuard Fireware OS, specifically affecting versions 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1. This critical flaw allows a remote, unauthenticated attacker to execute arbitrary code when Mobile User VPN with IKEv2 or Branch Office VPN using IKEv2 with a dynamic gateway peer is configured. The vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating a severe risk due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. Its EPSS score of 0.616090000 and FAUCET Risk Score of 100/100 further emphasize its significant threat. CVE-2025-9242 is actively exploited in the wild, as confirmed by its presence in the KEV catalog and CISA mandates for patching. While no Metasploit or ExploitDB modules are publicly available, Nuclei templates exist, and the vulnerability has garnered substantial community discussion and media coverage, highlighting its widespread concern.