WatchGuard Firebox OS 2025.1 / 12.x < 12.11.4 / 12.5.x < 12.5.13 / 11.x Out of Bounds Write Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277584);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/17");

  script_cve_id("CVE-2025-9242");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/12/03");

  script_name(english:"WatchGuard Firebox OS 2025.1 / 12.x < 12.11.4 / 12.5.x < 12.5.13 / 11.x Out of Bounds Write Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"A network security appliance running on the remote host is affected by out of bounds Write vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of WatchGuard Firebox OS running on the remote host is 
2025.1, 12.x prior to 12.11.4, 12.5.x prior to 12.5.13, or 11.x. It is, therefore, affected by out of 
bounds Write vulnerability.

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated 
attacker to execute arbitrary code. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Drupal version 10.4.9 / 10.5.6 / 11.1.9 / 11.2.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9242");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:watchguard:fireware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("watchguard_firebox_fireware_web_detect.nbin");
  script_require_keys("installed_sw/WatchGuard FireboxV");
  script_require_ports("Services/www", 8080, 443);

  exit(0);
}

include('vcf.inc');
include('http.inc');


var port = get_http_port(default:8080);

var app_info = vcf::get_app_info(app:'WatchGuard FireboxV', port:port, webapp:TRUE);
var model = app_info.Device;
var constraints;


if (model =~ "^T(1|3)5$")
{
    constraints = [
        { 'min_version' : '12.5', 'fixed_version' : '12.5.13' },
    ];
}
else if (app_info.version =~ "^12\.3\.1")
{
    if (report_paranoia < 2)
    {
        audit(AUDIT_POTENTIAL_VULN, 'WatchGuard Firebox OS');
    } 
    else 
    {
        constraints = [
            { 'fixed_display':'See vendor advisory' }
        ];
    }
}
else
{
    constraints = [
        { 'min_version' : '11.0', 'max_version' : '11.99', 'fixed_display':'See vendor advisory' },
        { 'min_version' : '12.0', 'fixed_version' : '12.11.4' },
        { 'equal': '2025.1', 'fixed_version':'2025.1.1'}
    ];
}



vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);