What is the CVSS score of CVE-2025-11838?

CVE-2025-11838 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fireware are affected by CVE-2025-11838?

WatchGuard firewall devices running vulnerable Fireware OS versions are exposed to unauthenticated denial-of-service attacks targeting VPN functionality, potentially disrupting remote worker…

How to fix or mitigate CVE-2025-11838?

Within 24 hours: Inventory all WatchGuard Fireware OS instances and identify those running versions 12.6.1-12.11.4 or 2025.1-2025.1.2 with IKEv2 VPN enabled; disable IKEv2 VPN if operationally feasible or restrict VPN gateway access via network ACLs. Within 7 days: Establish continuous monitoring for DoS patterns on affected devices; prepare rollback procedures and alternative VPN connectivity options. Within 30 days: Monitor WatchGuard security advisories for patch availability and test in non-production environments immediately upon release; deploy patches to production systems on a prioritized schedule based on VPN criticality.

Fireware CVE-2025-11838

EUVD-2025-201298 HIGH

Release of Invalid Pointer or Reference (CWE-763)

2025-12-04 5d1c2695-1a31-4499-88ae-e847036fd7e3

Microsoft Buffer Overflow Denial Of Service Fireware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201298

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 22:15 nvd

HIGH 7.5

DescriptionCVE.org

A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.

Analysis

This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users.

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More in Fireware

View all

CVE-2025-9242 CRITICAL Emergency POC

9.3 Sep 17

WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut

CVE-2013-6021 CRITICAL Act Now POC

9.3 Oct 19

Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code

CVE-2022-26318 CRITICAL Emergency POC

9.8 Mar 04

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti

CVE-2017-14616 HIGH This Week POC

7.5 Sep 20

An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability

CVE-2017-8056 MEDIUM This Month POC

5.3 Apr 22

WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a

CVE-2022-31790 HIGH This Week POC

7.5 Sep 06

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv

CVE-2017-14615 MEDIUM This Month POC

6.1 Sep 20

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit

CVE-2022-31789 CRITICAL Act Now

9.8 Sep 06

An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buff

CVE-2017-8055 MEDIUM This Month POC

5.3 Apr 22

WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3

CVE-2022-25361 CRITICAL Act Now

9.1 Jun 07

WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited

CVE-2014-0338 MEDIUM This Month POC

4.3 Mar 16

Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM b

CVE-2022-25360 HIGH This Week

8.8 Feb 24

WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload fil

Same weakness CWE-763 – Release of Invalid Pointer or Reference

View all

CVE-2024-44852 CRITICAL POC

9.8

CVE-2020-11105 CRITICAL POC

9.8

CVE-2018-6836 CRITICAL POC

9.8

CVE-2024-6607 HIGH POC

8.8

CVE-2023-34312 HIGH POC

7.8

CVE-2022-28203 HIGH POC

7.5

CVE-2022-37451 HIGH POC

7.5

CVE-2021-21401 HIGH POC

7.1

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

CVE-2025-11838 vulnerability details – vuln.today

Back

Fireware CVE-2025-11838

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Fireware

Same weakness CWE-763 – Release of Invalid Pointer or Reference

Same technique Buffer Overflow

Share

External POC / Exploit Code