WatchGuard Firebox Out-of-Bounds Write Exploitation (CVE-2025-9242)

let WatchGuardIPs = NetworkDeviceInfo
| where DeviceVendor has_any ("WatchGuard", "watchguard")
| project DeviceIP;
CommonSecurityLog
| where DeviceVendor has_any ("WatchGuard", "watchguard")
| where DeviceProduct has_any ("Firebox", "fireware")
| where Activity has_any ("crash", "segfault", "stack overflow", "memory corruption", "out of bounds", "buffer", "core dump", "exception", "fatal")
    or Message has_any ("OOB", "write violation", "access violation", "heap corruption", "stack smash")
| project TimeGenerated, DeviceVendor, DeviceProduct, DeviceVersion, SourceIP, DestinationIP, Activity, Message, AdditionalExtensions
| union (
    NetworkDeviceLog
    | where RawLog has_any ("watchguard", "firebox", "fireware")
    | where RawLog has_any ("crash", "segfault", "out of bounds", "write violation", "buffer overflow", "heap", "exception", "core dump")
    | project TimeGenerated, SourceIP, RawLog
)
| order by TimeGenerated desc

index=network (sourcetype=watchguard OR sourcetype=syslog) (source="*watchguard*" OR source="*firebox*" OR vendor="WatchGuard")
| where match(lower(_raw), "crash|segfault|out.of.bounds|write.violation|buffer.overflow|heap.corruption|stack.smash|access.violation|core.dump|fatal.error|exception")
| eval exploit_indicator=case(
    match(lower(_raw), "write.violation|out.of.bounds|heap.corruption|stack.smash"), "high",
    match(lower(_raw), "crash|segfault|core.dump"), "medium",
    match(lower(_raw), "exception|fatal.error"), "low",
    true(), "unknown"
  )
| stats count AS event_count, values(src_ip) AS source_ips, values(dest_ip) AS dest_ips, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, exploit_indicator
| where event_count >= 1
| sort - exploit_indicator, - event_count

sequence by host.name with maxspan=5m
  [network where event.category == "network" and
   (host.vendor : "WatchGuard" or host.product : "Firebox" or tags : "watchguard") and
   network.direction : ("ingress", "inbound")]
  [any where event.category in ("process", "system") and
   (message : ("crash", "segfault", "out of bounds", "write violation", "buffer overflow", "heap corruption", "stack smash", "access violation", "core dump", "fatal") or
    error.message : ("OOB", "write violation", "access violation", "heap corruption"))]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  logsourcename(logsourceid) AS log_source,
  category,
  QIDNAME(qid) AS event_name,
  UTF8(payload) AS raw_payload
FROM events
WHERE
  (logsourcetypename(devicetype) ILIKE '%watchguard%'
   OR logsourcename(logsourceid) ILIKE '%firebox%'
   OR UTF8(payload) ILIKE '%watchguard%')
  AND (
    UTF8(payload) ILIKE '%crash%'
    OR UTF8(payload) ILIKE '%segfault%'
    OR UTF8(payload) ILIKE '%out of bounds%'
    OR UTF8(payload) ILIKE '%write violation%'
    OR UTF8(payload) ILIKE '%buffer overflow%'
    OR UTF8(payload) ILIKE '%heap corruption%'
    OR UTF8(payload) ILIKE '%stack smash%'
    OR UTF8(payload) ILIKE '%access violation%'
    OR UTF8(payload) ILIKE '%core dump%'
    OR UTF8(payload) ILIKE '%fatal error%'
  )
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=network/watchguard OR _sourceCategory=firewall/watchguard OR _sourceName=*firebox*
| where _raw matches /(?i)(crash|segfault|out.of.bounds|write.violation|buffer.overflow|heap.corruption|stack.smash|access.violation|core.dump|fatal.error)/
| parse regex "(?i)src[_\s]?ip[\s=:]+(?<src_ip>[\d\.]+)" nodrop
| parse regex "(?i)dst[_\s]?ip[\s=:]+(?<dst_ip>[\d\.]+)" nodrop
| count by _sourceHost, src_ip, dst_ip, _raw
| sort by _count desc

rule cve_2025_9242_watchguard_firebox_oob_write {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects WatchGuard Firebox crash/memory-corruption events indicating potential CVE-2025-9242 exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"

  events:
    (
      $e.metadata.vendor_name = /(?i)watchguard/ or
      $e.metadata.product_name = /(?i)firebox/
    )
    and (
      $e.metadata.description = /(?i)(crash|segfault|out of bounds|write violation|buffer overflow|heap corruption|stack smash|access violation|core dump|fatal error)/ or
      $e.principal.labels["raw_message"] = /(?i)(crash|segfault|out of bounds|write violation|buffer overflow|heap corruption)/
    )

  condition:
    $e
}

#event_simpleName IN ("NetworkReceiveAccepted", "NetworkConnectIP4", "NetworkConnectIP6", "ProcessRollup2", "SyntheticProcessRollup2")
| LocalAddressIP4 = *
| (DeviceVendor = "WatchGuard" OR FileName IN ("watchguard", "firebox", "fireware"))
| (CommandLine = /(?i)(crash|segfault|oob|buffer.overflow|heap.corruption|write.violation)/ OR FileName = /(?i)(crash|core)/ OR ParentCommandLine = /(?i)(crash|segfault|oob)/)
| groupBy([DeviceId, LocalAddressIP4, RemoteAddressIP4, FileName, CommandLine], function=count())
| sort(count, order=desc)