Loading vulnerability…
CVE-2025-9242 is a critical out-of-bounds write vulnerability in the iked process of WatchGuard Fireware OS, the Internet Key Exchange daemon responsible for establishing IPsec VPN tunnels. The flaw affects Firebox appliances when Mobile User VPN with IKEv2 is enabled or when Branch Office VPN using IKEv2 is configured with a dynamic gateway peer. Available reporting indicates the vulnerable condition is reachable during the IKE handshake before authentication, and research has described the root cause as a missing length check on an identification buffer, leading to memory corruption. A remote unauthenticated attacker can exploit this condition to execute arbitrary code on the affected firewall. WatchGuard also noted a residual exposure condition in which a device may remain vulnerable even after deleting previously affected IKEv2 configurations if a branch office VPN to a static gateway peer remains configured.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a standalone Python exploit package for CVE-2025-9242 targeting WatchGuard Fireware 12.7 build 640389 with an M270-specific archived profile. Structure is minimal: README/NOTICE/MANIFEST metadata, requirements.txt, a large protocol/exploit engine (engine.py), and a CLI wrapper (wg_cve_2025_9242.py). The CLI exposes three modes: detect, analyze, and exploit. Detect performs a non-overflowing IKEv2 IKE_SA_INIT exchange to fingerprint firmware/build without sending the documented 513-byte trigger. Analyze is offline-only and builds the reverse-shell shellcode plus final payload for validation/hashing. Exploit first repeats exact-version/build detection, then—only if the target matches 12.7/640389 and the operator supplies explicit confirmation flags—builds and sends a pre-authentication RCE payload. The engine implements IKEv2 protocol handling, version/build fingerprint extraction, and a version-pinned ROP chain. The included gadget table and comments show the exploit is tailored to a specific Fireware build, using GOT-based resolution of mprotect, runtime page alignment, and a jump into attacker-supplied shellcode. The runtime payload is generated with pwntools as amd64 Linux shellcode that executes /usr/bin/python with inline Python code to connect back to an operator-supplied IPv4 callback, send uid/euid, redirect stdio, and spawn an interactive interpreter. Overall, this is a real active exploit rather than a detector-only script; it is operational but narrowly scoped to one exact target profile and includes safety gating to reduce accidental misuse.
This repository contains a Python exploit script (watchTowr-vs-WatchGuard-CVE-2025-9242.py) and a README.md. The exploit targets WatchGuard Firebox/WatchGuard OS devices vulnerable to CVE-2025-9242, an unauthenticated remote code execution vulnerability in the IKEv2 service. The script can both detect vulnerable firmware versions and, if instructed, deliver a custom ROP chain and shellcode payload to achieve code execution. The exploit operates over the network, targeting UDP port 500 (IKEv2) on the remote device. The README provides usage instructions, affected versions, and example command lines. The code is operational, with hardcoded ROP gadgets for specific firmware versions, and requires the attacker to specify both the target and local host/port for exploitation. No external C2 or hardcoded domains are present; all endpoints are user-supplied or local. The repository is focused, with clear separation between documentation and exploit code.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
162 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a nuclei template whose CPE format was corrected by adding a missing 13th field.
Specific vulnerability template referenced in a nuclei-templates pull request for CPE format correction.
Critical WatchGuard Fireware out-of-bounds write vulnerability added to KEV due to active exploitation; enables no-login attacks.
An out-of-bounds write vulnerability in WatchGuard Firebox firmware, enabling remote code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.