YIKES WatchGuard Fireware OS IKEv2 out-of-bounds write (CVE-...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/
• Blog Title: YIKES: WatchGuard Fireware OS IKEv2 out-of-bounds write (CVE-2025-9242)
• Suggested Section: Pentesting Network/IPsec & IKEv2 Attacks (enumeration, fingerprinting, and exploitation of IKEv2 daemons on VPN appliances)

🎯 Content Summary

Vuln overview
CVE-2025-9242 is a pre-authentication stack-based buffer overflow in WatchGuard Fireware OS’s IKEv2 daemon (/usr/bin/iked). It impacts both Mobile User VPN (IKEv2) and Branch Office VPN (IKEv2) when the peer is configured as a dynamic gateway. Critically, even if IKEv2 dynamic peers were removed later, devices may remain vulnerable if a Branch Office VPN to a static peer is still configured. CVSS 4.0: 9.3 (Critical). Affected versions: 11.10.2–11.12.4_Update...

🔧 Technical Details

Unauthenticated IKEv2 reachability to memory corruption
Abuse the IKEv2 handshake flow: a valid IKE_SA_INIT followed by IKE_SA_AUTH allows attacker-controlled Identification (IDi) to be processed before certificate validation. Oversized IDi triggers a stack overflow in the CERT handling routine, granting control of saved registers and RIP.

Fingerprinting via non-standard Vendor ID
Leverage WatchGuard’s custom Vendor ID extension: parse base64 following the 32‑byte hash to extract VN/BN (version/build). This enables single‑packet, pre‑auth version identification to rapidly scope exposure.

Mitigation bypass model
When NX is present but other mitigations are absent (no PIE/canaries), construct a ROP chain to adjust memory protections (e.g., mprotect) and then execute injected code. If /bin/sh is unavailable, pivot to an existing userland interpreter (e.g., Pytho...

🤖 Agent Actions

I analyzed the blog and found concrete, highly technical content relevant to IPsec/IKEv2 pentesting: a pre-auth stack overflow in WatchGuard’s IKEv2 daemon, a practical IKEv2 fingerprinting technique via a non-standard Vendor ID, and exploitation notes for environments with NX but lacking PIE/canaries. These techniques fit best in the existing “IPsec/IKE VPN” page.

What I changed

• Updated src/network-services-pentesting/ipsec-ike-vpn-pentesting.md to add:
  • IKEv2-specific Vendor ID fingerprinting for WatchGuard Fireware OS:
    • Explained the custom VID structure (32-byte hash + base64 tail with VN/BN).
    • Included an example hexdump and a one-liner for decoding the base64 to recover version/build.
    • Noted applicability on UDP/500 and UDP/4500 (NAT-T) in IKE_SA_INIT without auth.
  • IKEv2 exploitation notes:
    • Documented the protocol path to pre-auth memory corruption reachable via IKE_SA_AUTH processing of IDi/CERT, highlighting the bug pattern (oversized IDi copied before cert validation).
    • Added practical exploitation model for systems with NX only (ROP mprotect + shellcode; or pivot to /usr/bin/python3 if no /bin/sh).
    • Listed transforms observed on WatchGuard 12.11.3 for realistic negotiation expectations.
    • Practical scanning tips for UDP/500 and UDP/4500.
  • Expanded Shodan section to include UDP/4500 and a WatchGuard indicator.
  • Added a “## References” section at the end of the file, as required, citing the WatchTowr blog.

File modified

• src/network-services-pentesting/ipsec-ike-vpn-pentesting.md

Why this location

• The page already covers IPsec/IKE enumeration and attacks. The new IKEv2 fingerprinting trick and exploitation flow are a precise fit for this page (vs. creating a new page or using generic-hacking).

References added

• YIKES: WatchGuard Fireware OS IKEv2 out-of-bounds write (CVE-2025-9242) https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/

No other changes were necessary.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/yikes-watchguard-fireware-os-ikev2-out-of-bounds-write-cve-2025-9242/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Network/IPsec & IKEv2 Attacks (enumeration, fingerprinting, and exploitation of IKEv2 daemons on VPN appliances)".

Repository Maintenance:

• MD Files Formatting: 901 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge