ZDI-26-427: WatchGuard FireWare OS iked ike2_hmac Null Pointer Dereference Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of WatchGuard FireWare OS. Authentication is not required to exploit this vulnerability, but only systems using VPN with IKEv2 are vulnerable. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-13084.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard FireWare OS (iked/ike2_hmac)to a version that resolves this vulnerability.Patch ZDI-26-427 - Compensating control
If you cannot patch immediately, limit exposure by ensuring only VPN systems using IKEv2 are reachable as required, since systems using VPN with IKEv2 are vulnerable.
Event History
Frequently Asked Questions
What is the severity of ZDI-26-427?
ZDI-26-427 has a CVSS rating of 5.9, indicating a medium severity level.
How do I fix ZDI-26-427?
To fix ZDI-26-427, update the WatchGuard FireWare OS to the latest version that addresses this vulnerability.
What systems are affected by ZDI-26-427?
ZDI-26-427 affects only systems using VPN with IKEv2 in WatchGuard FireWare OS.
Is authentication required to exploit ZDI-26-427?
No, authentication is not required to exploit ZDI-26-427.
What type of vulnerability is ZDI-26-427?
ZDI-26-427 is a denial-of-service vulnerability caused by a null pointer dereference.