PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-9242 WatchGuard CVE debrief

CVE-2025-9242 is a WatchGuard Firebox out-of-bounds write vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2025-11-12. Because it is listed in KEV, defenders should treat it as a priority issue and follow vendor and CISA guidance without delay. CISA set a remediation due date of 2025-12-03.

Vendor
WatchGuard
Product
Firebox
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-11-12
Original CVE updated
2025-11-12
Advisory published
2025-11-12
Advisory updated
2025-11-12

Who should care

Organizations that use WatchGuard Firebox appliances, especially security teams, network administrators, and anyone responsible for perimeter devices or managed network security services.

Technical summary

The issue is identified as an out-of-bounds write in WatchGuard Firebox. The supplied sources do not provide additional technical details such as affected versions, attack conditions, impact scope, or a CVSS score. CISA’s KEV entry confirms the vulnerability is in active defensive priority and points to the vendor advisory WGSA-2025-00015 and the NVD record for more detail.

Defensive priority

High. KEV inclusion means this vulnerability should be handled as an urgent remediation item, with the CISA due date of 2025-12-03 used as the operational deadline.

Recommended defensive actions

  • Review WatchGuard advisory WGSA-2025-00015 and apply the vendor’s mitigations or updates as directed.
  • If mitigations are unavailable, follow CISA guidance to discontinue use of the product until a safe remediation path exists.
  • Track the CISA KEV entry and NVD record for any updated technical or remediation details.
  • Inventory all WatchGuard Firebox deployments, including internet-facing and branch-office appliances, to confirm exposure and remediation status.
  • Prioritize validation of remediation before the CISA due date of 2025-12-03.

Evidence notes

This debrief is based only on the supplied CVE metadata, CISA KEV entry, and official resource links. The source corpus identifies the issue as an out-of-bounds write in WatchGuard Firebox and records CISA KEV addition on 2025-11-12 with a remediation due date of 2025-12-03. No CVSS score, affected-version list, or exploit details were provided in the corpus.

Official resources

Publicly disclosed on 2025-11-12, the same date it appeared in the supplied CISA KEV metadata. Treat the CVE published date, not any later publication or analysis date, as the disclosure date.