WatchGuard Fireware CVE-2025-11838

Exploitation requires Fireware OS 12.6.1-12.11.4 or 2025.1-2025.1.2 with either (a) the Mobile User VPN service configured to use IKEv2, or (b) the Branch Office VPN service configured with IKEv2 and specifically a dynamic gateway peer - the dynamic gateway peer setting is an explicit and documented prerequisite for the Branch Office VPN attack path. No authentication is required per the CVSS 4.0 vector (PR:N); the attacker only needs network-level reachability to the IKEv2 UDP ports. Impact is strictly limited to availability - no confidentiality or integrity compromise is possible through this flaw alone. Deployments using only IKEv1, SSL/TLS VPN, or static gateway peers in Branch Office VPN configurations are not affected. The flaw does not enable remote code execution, privilege escalation, or lateral movement.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures the zero-friction attack surface: the IKEv2 service is perimeter-exposed by design on UDP/500 and UDP/4500, requires no credentials to reach, and a successful exploit immediately drops VPN availability for all connected users and branch offices. However, the EPSS score of 0.07% at the 20th percentile substantially tempers urgency from a threat intelligence standpoint, indicating no observed exploitation tooling or significant attacker interest at time of analysis. No CISA KEV listing and no public proof-of-concept have been identified. The impact is strictly availability-bounded - VC:N and VI:N confirm no data theft or integrity compromise is achievable through this path alone - which limits the blast radius to VPN outage rather than network compromise. Despite the low exploitation probability, the perimeter-facing nature of the service means that even a mid-sized municipal IT team in leszno running WatchGuard appliances for remote access should treat patching as a near-term priority, since VPN downtime during a targeted disruption campaign could isolate remote workers or branch sites. The 'dynamic gateway peer' prerequisite for Branch Office VPN narrows the exposed population somewhat, while Mobile User VPN exposure is broader. EPSS and KEV signals are consistent with a newly disclosed vulnerability that has not yet attracted weaponization.

An unauthenticated attacker who can reach the WatchGuard appliance's IKEv2 listener on UDP/500 or UDP/4500 crafts a malformed IKEv2 negotiation packet that triggers release of an invalid memory pointer in Fireware OS, causing the VPN process to crash. This immediately severs all active Mobile User VPN sessions and, where dynamic gateway peers are configured, all Branch Office VPN tunnels, until an administrator restarts the service. No public exploit code has been identified at time of analysis, but the unauthenticated pre-authentication processing path makes independent development straightforward for a motivated attacker.