SecBoard
Zurück zur CVE-Übersicht

CVE-2025-9242

CRITICAL(9.8)KEV — Aktiv ausgenutzt

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score82/100 — KRITISCH
  • CVSS 9.8 — Kritisch
  • EPSS 91% — sehr wahrscheinlich ausgenutzt
  • Im CISA KEV-Katalog (aktiv ausgenutzt)

CISA KEV

Bestätigt ausgenutzt

EPSS-Score

91.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

SecBoard-Einordnung

CVE-2025-9242 beschreibt eine Out-of-bounds Write Schwachstelle im iked-Prozess des WatchGuard Fireware OS. Diese Lücke ermöglicht einem nicht authentifizierten Angreifer die Remotecodeausführung. Betroffen sind Firebox-Geräte, die für Mobile User VPN mit IKEv2 oder Branch Office VPN mit IKEv2 und dynamischem Gateway konfiguriert sind, oder waren und nun ein statisches Branch Office VPN nutzen.

Die Schwachstelle ist mit einem CVSS-Score von 9.8 als kritisch eingestuft und weist eine hohe Exploit-Wahrscheinlichkeit von 91% () auf. Besonders besorgniserregend ist, dass CVE-2025-9242 in gelistet ist, was bedeutet, dass sie aktiv ausgenutzt wird und ein erhebliches Risiko darstellt.

Security-Teams sollten umgehend alle betroffenen WatchGuard Fireware OS-Instanzen identifizieren und die vom Hersteller bereitgestellten Patches oder Mitigationen anwenden. Angesichts der aktiven Ausnutzung und der Remotecodeausführungspriorität ist eine sofortige Reaktion erforderlich, um potenzielle Kompromittierungen zu verhindern.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Erkennung & Indikatoren

Ausnutzung

Actively exploited in the wild. CISA KEV catalog lists it as exploited. WatchGuard updated their advisory due to potential active exploits in the wild.

Threat-Hunting-Queries

The vulnerability is an Out-of-bounds Write in the 'iked' process of WatchGuard Fireware OS, allowing remote unauthenticated code execution. Detection should focus on unusual activity related to the 'iked' process, especially unexpected process spawns, network connections, or high resource utilization, particularly when IKEv2 VPNs are configured. WatchGuard mentions 'IDi payload size IOA' and 'IKE

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "iked" or ProcessCommandLine contains "iked"
| where InitiatingProcessFileName !~ "iked" // Look for iked being spawned by something unusual
| extend ParentProcessName = InitiatingProcessFileName
| extend ParentProcessCommandLine = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ActionType
| union DeviceNetworkEvents
| where InitiatingProcessFileName =~ "iked"
| where RemoteIP != "" and RemoteIP !in ("127.0.0.1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType

Splunk SPL

index=* (process_name="iked" OR command_line="*iked*")
| eval parent_process_name=if(isnull(parent_process_name), "N/A", parent_process_name)
| where parent_process_name!="iked" // Look for iked being spawned by something unusual
| table _time, host, parent_process_name, parent_command_line, process_name, command_line
| append [ search index=* process_name="iked" (dest_ip!="" AND NOT (dest_ip LIKE "127.%" OR dest_ip LIKE "10.%" OR dest_ip LIKE "172.16.%" OR dest_ip LIKE "172.17.%" OR dest_ip LIKE "172.18.%" OR dest_ip LIKE "172.19.%" OR dest_ip LIKE "172.20.%" OR dest_ip LIKE "172.21.%" OR dest_ip LIKE "172.22.%" OR dest_ip LIKE "172.23.%" OR dest_ip LIKE "172.24.%" OR dest_ip LIKE "172.25.%" OR dest_ip LIKE "172.26.%" OR dest_ip LIKE "172.27.%" OR dest_ip LIKE "172.28.%" OR dest_ip LIKE "172.29.%" OR dest_ip LIKE "172.30.%" OR dest_ip LIKE "172.31.%" OR dest_ip LIKE "192.168.%" OR dest_ip="0.0.0.0"))
| table _time, host, process_name, dest_ip, dest_port ]

Sigma

title: WatchGuard iked Out-of-Bounds Write Exploitation
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation of CVE-2025-9242 in WatchGuard Firebox devices by monitoring unusual 'iked' process activity or network connections.
author: SecBoard
date: 2025/09/17
modified: 2025/11/07
references:
  - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-9242
tags:
  - attack.initial_access
  - attack.execution
  - cve.2025.9242
  - watchguard
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith: '\iked'
    ParentImage|!endswith: '\iked' # iked spawned by something other than iked itself
  selection_network:
    Image|endswith: '\iked'
    InitiatedConnections|exists: true
    DestinationIp|!startswith: ['127.', '10.', '172.16.', '172.17.', '172.18.', '172.19.', '172.20.', '172.21.', '172.22.', '172.23.', '172.24.', '172.25.', '172.26.', '172.27.', '172.28.', '172.29.', '172.30.', '172.31.', '192.168.', '0.0.0.0']
  condition: selection_process or selection_network
level: critical

Elastic ES|QL

FROM process
| WHERE process.executable.name == "iked" AND process.parent.executable.name != "iked"
| SELECT @timestamp, host.name, process.parent.executable.name, process.parent.command_line, process.executable.name, process.command_line
| UNION
FROM network
| WHERE process.executable.name == "iked" AND destination.ip != null AND NOT (destination.ip IN ('127.0.0.1') OR CIDR_MATCH(destination.ip, '10.0.0.0/8') OR CIDR_MATCH(destination.ip, '172.16.0.0/12') OR CIDR_MATCH(destination.ip, '192.168.0.0/16') OR destination.ip == '0.0.0.0')
| SELECT @timestamp, host.name, process.executable.name, destination.ip, destination.port

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
  • cpe:2.3:o:watchguard:fireware:2025.1:*:*:*:*:*:*:*

Referenzen