WatchGuard Fireware OS EUVD-2026-67335

The iked process must be running and reachable on UDP port 500 (or UDP 4500 for NAT-T), which is the default operational state on any WatchGuard Firebox with IPsec VPN enabled. No authentication, prior session state, or user interaction is required - the overflow is triggered during the unauthenticated IKE initiation phase before any credential exchange. Exploitation is limited to appliances where the IKE port is reachable from untrusted networks; organizations that block UDP 500/4500 at an upstream firewall or restrict it to known peer IPs reduce but do not eliminate risk. The impact is strictly a denial of service - no confidentiality or integrity compromise is indicated by the CVSS vector or description.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms remote, unauthenticated, low-complexity exploitation with high availability impact, consistent with an internet-exposed daemon that processes unauthenticated IKE initiation messages before any credential exchange occurs. No EPSS score was provided in the source intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified at time of analysis, which moderates immediate mass-exploitation risk. However, because iked is internet-facing by design on VPN gateways, the attack surface requires no special positioning - the affected port is the product's intended operating surface. The DoS impact, while bounded to availability, is operationally severe on a perimeter firewall: loss of the iked process simultaneously severs all IPsec tunnels, including remote-access VPN users and site-to-site links, and may require manual intervention to restore. Organizations of any size running WatchGuard Firebox appliances with IPsec VPN exposed to untrusted networks should treat this as a near-term patching priority.

An attacker with no prior access or credentials sends a malformed IKEv1 or IKEv2 initiation message - such as a crafted Security Association payload with an anomalous length field - directly to UDP port 500 on an internet-facing Firebox appliance. The iked process copies attacker-controlled data into a fixed-size stack buffer without bounds checking, corrupting the stack frame and crashing the daemon. All active and pending IPsec VPN tunnels terminate immediately, and VPN service remains unavailable until the process is restarted.