EUVD-2025-201298Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IKEv2 service with no authentication required; impact is high availability loss only, scope unchanged as only the VPN process crashes.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
5DescriptionCVE.org
A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.
This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.
AnalysisAI
Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.
Technical ContextAI
CWE-763 (Release of Invalid Pointer or Reference) identifies the root cause as improper memory management during IKEv2 packet processing. IKEv2 is the handshake protocol that negotiates IPsec security associations; because negotiation occurs before authentication completes, any externally reachable IKEv2 listener is exposed to unauthenticated crafted input. A malformed IKEv2 message causes Fireware OS to release an already-invalid or already-freed pointer, corrupting internal state and crashing the VPN process. The CPE data (cpe:2.3:o:watchguard:fireware) covers the entire Fireware OS family across the affected version branches. The 'Buffer Overflow' tag in the source data is consistent with memory corruption as the mechanism, though the authoritative root cause classification from NVD is CWE-763. The 'Microsoft' tag present in source intelligence appears to be a tagging artifact unrelated to this vulnerability.
RemediationAI
The primary fix is to apply the vendor-supplied patch; consult the WatchGuard PSIRT advisory directly at https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00018 and https://psirt.watchguard.com/CVE-2025-11838 for the confirmed patched Fireware OS version, as no specific fixed build number is independently verifiable from the available reference data. As a compensating control until patching is complete, restrict IKEv2 traffic (UDP/500 and UDP/4500) to known peer IP ranges using upstream ACLs or geo-blocking rules, which reduces the unauthenticated attack surface at the cost of blocking legitimate remote users from new or dynamic IP addresses. For Branch Office VPN specifically, converting dynamic gateway peer configurations to static gateway peers eliminates that attack path entirely, though this introduces administrative overhead for sites with dynamically assigned IPs. Organizations should also enable alerting on unexpected VPN process restarts or IKEv2 session failure spikes as a detection measure during the remediation window.
WatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. Rated high severity (CVSS 7.5), this vulnerability
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC a
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication serv
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. Rated medium severity (CVSS 6.1), this vulnerabilit
An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buff
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. Rated medium severity (CVSS 5.3
WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited
Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM b
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today