CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No

Gladinet Triofox versions prior to 16.7.10368.56560 contain an improper access control flaw (CWE-284) that leaves the product's initial setup pages reachable without authentication even after initial configuration is complete. Because the flaw requires no privileges, user interaction, or special conditions (CVSS:3.1 AV:N/AC:L/PR:N/UI:N), a remote attacker can reach these setup pages on an internet-reachable Triofox server. By re-entering the setup flow, an attacker can reconfigure the deployment, and public reporting indicates attackers abused this to run malicious payloads via the antivirus configuration feature and install remote access tools, producing high confidentiality and integrity impact (C:H/I:H/A:N). Any organization running an affected Triofox version, whether deployed on-premises or as a cloud service, is exposed. The flaw is being actively exploited: Google/Mandiant published a public technical writeup, CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-12, and EPSS puts the 30-day exploitation probability at 90.5% (100th percentile).

Do: Upgrade Triofox to version 16.7.10368.56560 or later per vendor instructions; where patching is not immediately possible, apply vendor mitigations, restrict access to the setup pages, and note that federal agencies must follow CISA BOD 22-01 guidance (including for cloud services) or discontinue use. Given confirmed in-the-wild exploitation, check for compromise: review the antivirus configuration for tampering, hunt for installed remote access tools or unexpected payloads, and audit accounts and configuration changes made after initial setup.

A race condition (improper synchronization of concurrent access to shared resources, tracked alongside a double-free issue, CWE-362/CWE-415) in the Microsoft Windows Kernel allows an authenticated local attacker to elevate privileges. To trigger it, an attacker with low privileges must run code that races kernel operations on a shared resource; the high attack complexity means timing must line up, but successful races corrupt kernel state and yield elevated execution. A successful exploit grants the attacker kernel/SYSTEM-level access with high impact on confidentiality, integrity, and availability of the host. All Windows 10 builds from 1809 through 22H2, Windows 11 23H2 through 25H2, and Windows Server 2019 through 2025 are affected. Microsoft patched the flaw in its November 2025 Patch Tuesday release, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-12 as actively exploited in the wild; no public PoC is known and ransomware use is unconfirmed.

Do: Apply Microsoft's November 2025 Patch Tuesday security updates for every affected Windows 10, Windows 11, and Windows Server version, prioritizing servers, domain controllers, and multi-user hosts where local privilege escalation has the greatest downstream impact. Because the flaw requires only low local privileges, treat any unpatched system where untrusted users or malware can execute code (RDS/VDI, kiosks, developer workstations) as at risk, and US federal agencies must remediate per CISA BOD 22-01 timelines. After deployment, verify the OS build reflects the November 2025 update, as active exploitation is confirmed even though no public PoC is available.

WatchGuard Fireware OS contains an out-of-bounds write (CWE-787) in the iked process that a remote, unauthenticated attacker can trigger to execute arbitrary code on the appliance. The flaw is reachable via the mobile user VPN with IKEv2 and via branch office VPNs using IKEv2 to a dynamic gateway peer; devices whose IKEv2 configurations were deleted may remain vulnerable if a branch office VPN to a static gateway peer is still configured. Successful exploitation yields full system compromise, reflected in the CVSS v4.0 base score of 9.3 (network vector, no privileges or user interaction, high impact on confidentiality, integrity and availability). WatchGuard Firebox appliances with IKEv2 VPN services are affected, with public reporting citing roughly 54,000 internet-exposed Fireboxes; the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2025-11-12, a public proof-of-concept exploit exists, and headlines indicate use in ransomware attacks (KEV ransomware field is listed as unknown). EPSS assigns a 91.3% probability of exploitation within 30 days (100th percentile), so remediation urgency is high.

Do: Apply the patched Fireware OS release per WatchGuard's security advisory immediately (exact fixed version numbers are not provided in the source data); the KEV listing makes BOD 22-01 remediation timelines mandatory for U.S. federal agencies. As an interim mitigation, restrict or disable IKEv2 VPN exposure — mobile user VPN with IKEv2 and branch office VPN IKEv2, including residual static-peer BOVPN configurations on devices that previously had IKEv2 configured — to trusted sources only. Administrators should audit configuration history to identify Fireboxes with prior IKEv2 mobile VPN or dynamic-peer BOVPN setups, since these may remain vulnerable even after the configs were deleted.