WatchGuard Fireware flaw allows remote code execution via IKEv2

WatchGuard has warned of a critical vulnerability in its Fireware operating system that can allow remote attackers to execute code on exposed devices without authentication, security researchers and the company said. Tracked as CVE20259242 and rated 9.3 on the CVSS scale, the flaw was disclosed in mid-September and affects a range of Fireware OS releases and Firebox appliances that terminate IKEv2 VPN connections.

The bug is an out-of-bounds write in the Fireware iked process that handles IKEv2 VPN negotiations, WatchGuard said. "This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer," the company advisory stated. Researchers who published a technical analysis said the defect stems from a function called ike2_ProcessPayload_CERT, where a client identification value can be copied into a 520-byte stack buffer without length checks during the IKE_SA_AUTH phase, enabling a buffer overflow and potential full remote code execution.

WatchTowr researchers demonstrated how an attacker could seize control of execution, bypass common protections and spawn interactive shells on compromised devices,...