Critical Out-of-Bounds Write Vulnerability in WatchGuard Firebox

What changed

An out-of-bounds write vulnerability has been discovered in the WatchGuard Fireware OS, specifically within the iked process. This vulnerability enables remote unauthenticated attackers to execute arbitrary code, posing a significant security risk.

The issue primarily affects configurations utilizing IKEv2 for both mobile user VPNs and branch office VPNs, particularly when set up with dynamic gateway peers.

Who is affected

Organizations utilizing WatchGuard Firebox devices for their network security are at risk, especially those with specific VPN configurations.

The following groups are particularly vulnerable:

• Users of WatchGuard Firebox devices configured with mobile user VPN using IKEv2.
• Organizations employing branch office VPNs that utilize IKEv2 with dynamic gateway peers.
• Any Firebox configurations that previously had mobile user VPNs or branch office VPNs set up but have since been deleted may still be exposed if a static gateway peer is in use.

What to do

It is crucial for affected organizations to assess their Firebox configurations immediately. Administrators should verify VPN settings and ensure that any potentially vulnerable configurations are addressed.

Implement the following actions to mitigate risk:

• Review and update Firebox configurations, particularly focusing on VPN settings.
• Disable any unnecessary VPN configurations that may expose the system to this vulnerability.
• Monitor for any unusual activity that could indicate exploitation attempts.