Researchers Uncover WatchGuard VPN Bug That Could Let Attackers Take Over Devices

CVE-2025-3600 is an unsafe reflection vulnerability (CWE-470) in Progress Telerik UI for ASP.NET AJAX, present in all builds from 2011.2.712 through 2025.1.218, in which attacker-controlled input used in a reflection operation can cause an unhandled exception. When triggered, the exception crashes the hosting process (typically the application pool serving the web application), resulting in denial of service; the CVSS vector (AV:N/AC:L/PR:N/UI:N, availability-only impact) confirms there is no confidentiality or integrity impact. Because exploitation requires no privileges or user interaction over the network, any web application built with the affected versions and exposing Telerik components or handlers to unauthenticated traffic is at risk. No public proof-of-concept or CISA KEV listing is currently known, but the 24.1% EPSS score (98th percentile) indicates a significantly elevated probability of exploitation within the next 30 days. The roughly 14-year affected version span means the flaw is likely present in a large, long-lived installed base of .NET web applications.

Do: Upgrade Telerik UI for ASP.NET AJAX to a release newer than 2025.1.218 (confirm the exact fixed build in Progress's official security advisory). In the interim, inventory which web applications bundle Telerik UI for ASP.NET AJAX and restrict unauthenticated access to its handlers/endpoints, and ensure application-pool recovery or load-balanced redundancy is in place to limit denial-of-service impact. Monitor EPSS and the CISA KEV catalog, as the elevated 98th-percentile EPSS suggests exploitation activity may emerge soon.

Dell Unity versions 5.5 and prior contain an OS command injection flaw (CWE-78) in which special elements passed to an operating system command are not properly neutralized by the Unity operating environment. An unauthenticated, remote attacker can trigger the flaw by sending crafted input containing shell metacharacters, causing arbitrary commands to execute on the affected system. Successful exploitation gives the attacker command execution with high impact to confidentiality, integrity, and availability, reflected in the critical 9.8 CVSS score. Any organization running a Dell Unity array on version 5.5 or earlier is affected, with practical risk concentrated on arrays whose management interfaces are reachable from untrusted networks. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 63.9% EPSS score (99th percentile) signals a high predicted likelihood of exploitation within 30 days.

Do: Upgrade affected Unity systems to the fixed release identified in Dell's security advisory for CVE-2025-36604. Until patched, restrict network access to Unity management services to trusted management networks and eliminate any direct internet exposure of the array. Inventory your environment for Unity arrays running version 5.5 or earlier and prioritize internet-facing systems given the high EPSS score.

WatchGuard Fireware OS contains an out-of-bounds write (CWE-787) in the iked process that a remote, unauthenticated attacker can trigger to execute arbitrary code on the appliance. The flaw is reachable via the mobile user VPN with IKEv2 and via branch office VPNs using IKEv2 to a dynamic gateway peer; devices whose IKEv2 configurations were deleted may remain vulnerable if a branch office VPN to a static gateway peer is still configured. Successful exploitation yields full system compromise, reflected in the CVSS v4.0 base score of 9.3 (network vector, no privileges or user interaction, high impact on confidentiality, integrity and availability). WatchGuard Firebox appliances with IKEv2 VPN services are affected, with public reporting citing roughly 54,000 internet-exposed Fireboxes; the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2025-11-12, a public proof-of-concept exploit exists, and headlines indicate use in ransomware attacks (KEV ransomware field is listed as unknown). EPSS assigns a 91.3% probability of exploitation within 30 days (100th percentile), so remediation urgency is high.

Do: Apply the patched Fireware OS release per WatchGuard's security advisory immediately (exact fixed version numbers are not provided in the source data); the KEV listing makes BOD 22-01 remediation timelines mandatory for U.S. federal agencies. As an interim mitigation, restrict or disable IKEv2 VPN exposure — mobile user VPN with IKEv2 and branch office VPN IKEv2, including residual static-peer BOVPN configurations on devices that previously had IKEv2 configured — to trusted sources only. Administrators should audit configuration history to identify Fireboxes with prior IKEv2 mobile VPN or dynamic-peer BOVPN setups, since these may remain vulnerable even after the configs were deleted.