Which versions of WatchGuard Fireware are affected by CVE-2025-11838?

WatchGuard firewall devices running vulnerable Fireware OS versions are exposed to unauthenticated denial-of-service attacks targeting VPN functionality, potentially disrupting remote worker…

How to fix or mitigate CVE-2025-11838?

Within 24 hours: Inventory all WatchGuard Fireware OS instances and identify those running versions 12.6.1-12.11.4 or 2025.1-2025.1.2 with IKEv2 VPN enabled; disable IKEv2 VPN if operationally feasible or restrict VPN gateway access via network ACLs. Within 7 days: Establish continuous monitoring for DoS patterns on affected devices; prepare rollback procedures and alternative VPN connectivity options. Within 30 days: Monitor WatchGuard security advisories for patch availability and test in non-production environments immediately upon release; deploy patches to production systems on a prioritized schedule based on VPN criticality.

WatchGuard Fireware CVE-2025-11838

Q: What is the CVSS score of CVE-2025-11838?

CVE-2025-11838 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-201298 HIGH

Release of Invalid Pointer or Reference (CWE-763)

2025-12-04 5d1c2695-1a31-4499-88ae-e847036fd7e3

Buffer Overflow Watchguard Denial Of Service Microsoft Fireware

8.7

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable IKEv2 service with no authentication required; impact is high availability loss only, scope unchanged as only the VPN process crashes.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201298

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 22:15 cve.org

HIGH 8.7

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 7.5

DescriptionCVE.org

A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.

AnalysisAI

Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.

Technical ContextAI

CWE-763 (Release of Invalid Pointer or Reference) identifies the root cause as improper memory management during IKEv2 packet processing. IKEv2 is the handshake protocol that negotiates IPsec security associations; because negotiation occurs before authentication completes, any externally reachable IKEv2 listener is exposed to unauthenticated crafted input. A malformed IKEv2 message causes Fireware OS to release an already-invalid or already-freed pointer, corrupting internal state and crashing the VPN process. The CPE data (cpe:2.3:o:watchguard:fireware) covers the entire Fireware OS family across the affected version branches. The 'Buffer Overflow' tag in the source data is consistent with memory corruption as the mechanism, though the authoritative root cause classification from NVD is CWE-763. The 'Microsoft' tag present in source intelligence appears to be a tagging artifact unrelated to this vulnerability.

RemediationAI

The primary fix is to apply the vendor-supplied patch; consult the WatchGuard PSIRT advisory directly at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00018 and https://psirt.watchguard.com/CVE-2025-11838 for the confirmed patched Fireware OS version, as no specific fixed build number is independently verifiable from the available reference data. As a compensating control until patching is complete, restrict IKEv2 traffic (UDP/500 and UDP/4500) to known peer IP ranges using upstream ACLs or geo-blocking rules, which reduces the unauthenticated attack surface at the cost of blocking legitimate remote users from new or dynamic IP addresses. For Branch Office VPN specifically, converting dynamic gateway peer configurations to static gateway peers eliminates that attack path entirely, though this introduces administrative overhead for sites with dynamically assigned IPs. Organizations should also enable alerting on unexpected VPN process restarts or IKEv2 session failure spikes as a detection measure during the remediation window.