Critical · published December 19, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.0th percentile for exploit probability.
🚨 An out-of-bounds write in WatchGuard Fireware OS could let attackers execute arbitrary code without breaking a sweat — talk about a security breach on steroids! 🔥 Think of this as a construction worker who mistakenly builds a wall too far out, allowing anyone to sneak in through the newly created gap. In this case, the vulnerable VPN configurations are the walls that need proper reinforcement to keep the bad guys out. If exploited, a remote attacker could take total control of the system, leading to an absolute meltdown of your network — they could read, modify, or delete critical data, and even launch further attacks. This vulnerability is not just a minor hiccup; it’s a full-blown crisis waiting to happen!
Think of this as a construction worker who mistakenly builds a wall too far out, allowing anyone to sneak in through the newly created gap. In this case, the vulnerable VPN configurations are the walls that need proper reinforcement to keep the bad guys out. The out-of-bounds write vulnerability arises when the Fireware OS improperly handles memory, allowing attackers to write data outside the allocated bounds. This can lead to arbitrary code execution, which poses a significant risk to network security.
If exploited, a remote attacker could take total control of the system, leading to an absolute meltdown of your network — they could read, modify, or delete critical data, and even launch further attacks. This vulnerability is not just a minor hiccup; it’s a full-blown crisis waiting to happen! Immediately update your Fireware OS to versions 11.12.4_Update2, 12.11.6, or 2025.1.4 to patch this critical vulnerability. Ensure that all VPN configurations are audited, particularly those using IKEv2 with dynamic gateways, to prevent unauthorized access. You can handle this! Update those systems, secure your network, and you’ll be back in hero mode in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| watchguard/fireware | ≥ 11.10.2, < 12.5.15 | 12.5.15 |
| watchguard/fireware | ≥ 11.10.2, < 12.11.6 | 12.11.6 |
| watchguard/fireware | ≥ 2025.1, < 2025.1.4 | 2025.1.4 |