WatchGuard Patched This Firewall Bug Nine Months Ago. Someone Just Tuned the Exploit to Your Exact Firmware Build.
- Patrick Duggan
- a few seconds ago
- 5 min read
Most people think an exploit has a moment. The vulnerability drops, the proof-of-concept lands, there is a scramble to patch, and then the story ends. It does not end. The patch ships and the exploit keeps getting better, quietly, for the machines that never applied the fix — and this week we watched a nine-month-old firewall bug get sharpened to a specific firmware build.
The bug, and its already-long history
CVE-2025-9242 is an out-of-bounds write in the iked process of WatchGuard's Fireware OS — the code that handles IKEv2, the VPN key exchange. It rates 9.3, it is pre-authentication, and it lets a remote attacker with no credentials run arbitrary code on the firewall. A firewall is the worst possible thing to lose this way: it sits at the edge, it sees all the traffic, and it is trusted by everything behind it.
This is not new. The timeline is the point:
WatchGuard published the advisory on September 17, 2025. On October 16, the research firm watchTowr Labs released a public artifact demonstrating full pre-auth remote code execution — good, legitimate offensive-security work, done in the open, credited to them. Five days later, on October 21, WatchGuard updated its advisory with indicators of attack because the bug was being exploited in the wild. On November 12, CISA added it to the Known Exploited Vulnerabilities catalog with a three-week deadline for federal agencies. And around that time, Shadowserver counted more than seventy-five thousand exposed, vulnerable Fireboxes — other counts ran past a hundred thousand — most of them in North America.
That was nine months ago. The patch has existed the entire time.
What actually happened this week
A new proof-of-concept appeared, and its details are the story. It is a derivative of the watchTowr artifact — it says so, and credits the original — but it adds something the original did not have: it is pinned to an exact target. Not "WatchGuard Firebox" in general, but Fireware 12.7, build 640389, the M270 appliance profile specifically, with runtime page-alignment logic and strict build-checking that refuses to fire unless the target matches that profile.
Read that as a defender and it should chill you slightly, because it is the opposite of what you would expect from an aging bug. Nine months in, the public tooling for CVE-2025-9242 is not decaying into irrelevance. It is being refined. Someone took a general exploit and turned it into a build-specific instrument, the way you would fit a scope to a particular rifle for a particular distance. Exploit development does not stop at disclosure. For the population of boxes that never patched, it moves in exactly this direction — from "works against the vulnerability" to "works reliably against your specific firmware."
We looked closely at this particular sample and it is a legitimately-structured research artifact, not a trap for whoever runs it — the reverse shell calls back only to an address the operator supplies, there is no hidden payload, no poisoned dependency, no phone-home to someone else's infrastructure. We are not naming it or its author, because our analysis says researcher, not adversary, and we do not brand people on a hunch. The point is not this one repository. The point is what its existence proves about the lifecycle: the recipe for hitting unpatched Fireboxes is getting more precise, not less, and it is doing so in public.
Why the unpatched population is the whole game
The uncomfortable arithmetic of a vulnerability like this is that the vulnerable count barely moves after the initial scramble. The organizations that were going to patch in the first month did. The tens of thousands that did not are, disproportionately, the ones that cannot — the small business with a Firebox in a closet and no one watching it, the branch office whose IT is a contract that lapsed, the appliance everyone forgot was load-bearing until it is the thing that let someone in. Those are the boxes a build-pinned exploit is for. Not the well-run fleet that patched in October. The forgotten ones.
This is the group we care most about, because they are the ones a firehose of alerts never reaches and a hundred-thousand-dollar security program was never in the budget for. The honest message to them is not sophisticated: your firewall vendor shipped a fix nine months ago, the attack tooling aimed at you is still improving, and the gap between those two facts is the entire risk.
What to do, in the order that matters
If you run a WatchGuard Firebox, check your Fireware version now. The vulnerable range is broad — 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1 — so "we have a WatchGuard" is not the same as "we are fine." Update to a fixed release. WatchGuard has published fixed versions since last autumn; this is a matter of applying them, not waiting for them.
If you cannot update immediately, the exposure depends on configuration: the bug is reachable through the mobile-user VPN with IKEv2 and through a branch-office VPN using IKEv2 with a dynamic gateway peer. WatchGuard's advisory includes mitigation steps for disabling or constraining those paths, and if the device is exposed to the internet and you cannot patch or mitigate, the honest fallback is to take its VPN off the public internet until you can. An IKEv2 listener a stranger cannot reach is one this exploit cannot hit.
And because this bug has been exploited in the wild since last October, patching is necessary but not sufficient: if your Firebox was internet-exposed and unpatched during that window, treat it as potentially already touched. Review it for configuration changes you did not make, accounts you do not recognize, and VPN or tunnel definitions that appeared without a ticket behind them.
Where we stand on this
We are not breaking this and we will not pretend to be — CVE-2025-9242 has been a known, exploited, KEV-listed vulnerability since last autumn, and the original research is watchTowr's. There is nothing here for us to add to a blocklist, either: the vulnerability lives in our CISA KEV mirror already, and the proof-of-concept we examined is not attacker infrastructure to be fed anywhere. What we can add is the observation, because it is the part that does not make the initial headlines: nine months after the patch, the exploit for this thing is still being tuned, in public, to specific hardware — and the people that fact endangers are precisely the ones least likely to hear it. We hold this at 95 percent, as always. The technical details are WatchGuard's advisory and watchTowr's research, corroborated by the trade press; the lifecycle read is ours.
Sources: WatchGuard PSIRT advisory WGSA-2025-00015; watchTowr Labs, "yIKEs"; CISA KEV entry for CVE-2025-9242 (added November 12, 2025); BleepingComputer and Shadowserver exposure counts. CVE-2025-9242 is already in our CISA KEV mirror; no separate indicators were ingested for this campaign, and no proof-of-concept repository is named.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.