Overview
A critical memory corruption vulnerability, identified as CVE-2025-11838, has been discovered in WatchGuard Fireware OS. This vulnerability could allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.
Technical Details
CVE-2025-11838 stems from a memory corruption flaw within the IKEv2 VPN implementation in WatchGuard Fireware OS. When a dynamic gateway peer is configured, a specially crafted network packet can trigger memory corruption, leading to a system crash and a subsequent Denial of Service (DoS). The vulnerability is triggered remotely, requiring no authentication.
Affected Versions:
- Fireware OS 12.0 up to and including 12.11.4
- Fireware OS 2025.1 up to and including 2025.1.2
CVSS Analysis
Currently, the CVSS score for CVE-2025-11838 is not available (N/A). However, given the potential for an unauthenticated remote attacker to trigger a DoS, it is likely to be a high severity vulnerability. We will update this section once the official CVSS score is released.
Possible Impact
The primary impact of CVE-2025-11838 is a Denial of Service (DoS) condition. This means affected WatchGuard Fireware OS devices could become unresponsive, disrupting VPN services and potentially impacting network connectivity for users relying on Mobile User VPN and Branch Office VPN connections. The unauthenticated nature of the vulnerability makes it particularly concerning.
Mitigation or Patch Steps
The recommended mitigation is to update your WatchGuard Fireware OS to a patched version. Consult WatchGuard’s security advisory for specific instructions on how to upgrade your system. Here are the general steps:
- Visit the WatchGuard Support Center.
- Download the latest compatible Fireware OS version for your device.
- Follow the upgrade instructions provided by WatchGuard.
It is crucial to apply the patch as soon as possible to prevent potential exploitation of this vulnerability. Disabling the Mobile User VPN and Branch Office VPN using IKEv2 with dynamic gateway peers can be considered a temporary workaround, but is not a substitute for patching.
References
- WatchGuard Security Advisory: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00018
- CVE Details: https://www.cve.org/CVERecord?id=CVE-2025-11838
