CVE-2025-9242 - dubbed "yIKEs" by the discovering researchers at watchTowr Labs, is a critical, pre-authentication remote code execution vulnerability in the IKEv2 VPN service of WatchGuard Fireware OS, disclosed in September 2025. CERTVU is issuing this advisory now because CVE-2025-9242 continues to appear in Shadowserver Foundation internet-wide scanning data, which CERTVU monitors on a recurring basis. See also Advisory 312, CVE-2025-14733, disclosed roughly three months later in the same VPN component, a clear vendor-specific trend that makes this specific feature (IKEv2 VPN processing) worth a standing audit item rather than a one-off patch.

The following version(s) are affected:

Fireware OS 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1 – (Affected)
Fireware OS 12.11.4 and later – (Not affected, patched)

Upgrade Fireware OS to version 12.11.4 or later without delay.

Typical attack flow:

1. Send a crafted identification payload during IKE_SA_AUTH negotiation — A remote, unauthenticated attacker sends a maliciously crafted identification payload exceeding the expected 512-byte stack buffer to a Firebox's IKEv2 VPN service during IKE_SA_AUTH negotiation.
2. Overflow the stack buffer and achieve root-level remote code execution — The oversized payload overflows the stack buffer in the "ike2_ProcessPayload_CERT" function; in the absence of modern exploit mitigations on the affected binary, this allows the attacker to achieve arbitrary code execution with root-level privileges, as demonstrated by watchTowr Labs using a reverse Python shell.

Attack vectors:

• A network-based, unauthenticated, pre-authentication attack against any WatchGuard Firebox with IKEv2 VPN services reachable from an untrusted network - most critically the public internet.
• No user interaction or privileges are required.

Successful exploitation may allow attackers to:

• Execute arbitrary code with root-level privileges on a WatchGuard Firebox appliance, without any authentication, via a single crafted IKEv2 payload.
• Compromise the perimeter firewall/VPN gateway itself and use it to deploy ransomware or pivot further into the wider internal network the Firebox protects, both consistent with confirmed real-world attack activity against this specific flaw.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade Fireware OS to version 12.11.4 or later as an emergency change, given confirmed active exploitation including in ransomware attacks.

2. Disable IKEv2 VPN Services Where Patching Must Be Delayed

   Disable IKEv2 VPN services entirely where patching must be delayed.

3. Audit for the Related CVE-2025-14733 Vulnerability

   Audit for the related, separately-tracked IKEv2 vulnerability (CVE-2025-14733) on the same devices.

Report any suspected compromise of a WatchGuard Firebox appliance to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.