## https://sploitus.com/exploit?id=60BBC46A-F926-576C-A9F6-52E214FA7D71
# mass-scanner-CVE-2025-9242
Detection-only asynchronous IPv4 scanner for WatchGuard Fireware exposure
triage related to CVE-2025-9242.
The scanner sends one ordinary, non-overflowing IKEv2 `IKE_SA_INIT` request
per selected address and port, then parses any WatchGuard vendor
version/build fingerprint returned in the cleartext response.
It contains no `IKE_AUTH` builder, vulnerability trigger, shellcode,
authentication, enumeration, callback, or post-authentication logic.
## Features
- Interactive default-range or custom-range menu
- Packaged default plan: `82.127.0.0/16`
- Custom CIDR, single IPv4 address, or inclusive start-end range
- UDP/500 by default; optional UDP/500 and UDP/4500
- Fast `250 -> 500 -> 1,000 -> 2,000` pps ramp in about three seconds
- Hard 2,000 total probes/second ceiling
- Streaming address expansion and bounded outstanding state
- Pretty terminal display by default, with quiet and verbose alternatives
- Line-delimited JSON results and summary
- Explicit authorization acknowledgement before network execution
- Standard-library-only Python implementation
The packaged `/8` is a range-selection default, not an authorization claim.
Use it only if every selected address is explicitly authorized.
## Requirements
- Python 3.11 or newer
- Linux or another platform with Python asynchronous UDP support
- Explicit authorization for every selected address
No third-party Python packages are required.
## Quick start
The interactive menu defaults to a network-inert dry run:
```sh
python3 wg_ike_mass_scanner.py
```
The menu presents:
1. Default range: `82.127.0.0/16`
2. Custom IPv4 CIDR, single address, or inclusive start-end range
3. Exit
It then offers `Pretty` (default), `Quiet`, and `Verbose` display levels.
Pretty mode shows a readable plan, compact progress, exposure hits, and the
final summary. Quiet mode shows exposure hits, errors, and the final summary.
Verbose mode prints diagnostic JSON. All three modes write the same JSONL
evidence format.
Before network execution, the scanner explains that a dry run only previews
the scan plan and sends no packets. Press Enter or choose `Y` for the dry run.
Choose `n` only to continue toward the authorization confirmation for a
network scan.
## Dry-run examples
Preview the default plan without creating a socket:
```sh
python3 wg_ike_mass_scanner.py --default-range --dry-run
```
Preview a custom range and both IKE ports:
```sh
python3 wg_ike_mass_scanner.py \
--range 192.0.2.0/24 \
--ports 500,4500 \
--dry-run
```
CIDRs and inclusive ranges are streamed in ascending address order. A narrower
CIDR reaches addresses sooner and reduces total traffic; confirm that the
entire selected range is authorized.
Choose terminal detail with `--verbosity normal`, `--verbosity quiet`, or
`--verbosity verbose`. `normal` is the pretty default.
## Authorized network execution
Default packaged range:
```sh
python3 wg_ike_mass_scanner.py \
--default-range \
--ack-authorized
```
Custom range:
```sh
python3 wg_ike_mass_scanner.py \
--range 192.0.2.0/24 \
--ack-authorized
```
The acknowledgement confirms that every selected address is authorized. It
does not perform an ownership or rules-of-engagement lookup for you.
## Rate behavior
The default three-second ramp is:
```text
0-1 seconds: 250 pps
1-2 seconds: 500 pps
2-3 seconds: 1,000 pps
after 3 seconds: 2,000 pps
```
`--max-rate` can select a lower ceiling, and `--ramp-seconds` can slow the
ramp. Values above 2,000 pps are refused. The rate is total probes per second,
not addresses per second. Selecting two ports doubles the probe count.
## Output
The default terminal display is human-readable. Independently of terminal
verbosity, the scanner writes JSONL containing:
1. A `scan_start` record
2. One result record for each response
3. A `scan_summary` record
Timeouts are counted in the summary rather than written once per address.
Possible version-only statuses include:
- `EXACT_PROFILE_EXPOSURE`: Fireware `12.7`, build `640389`
- `AFFECTED_VERSION_EXPOSURE`
- `RESOLVED_VERSION`
- `WATCHGUARD_VERSION_UNPARSED`
- `WATCHGUARD_VERSION_REQUIRES_OWNER_REVIEW`
- `IKE_RESPONSE_NO_WATCHGUARD_FINGERPRINT`
In normal and quiet terminal modes, the exact `12.7` / `640389` profile is
shown as `[EXACT EXPOSURE]`; other affected versions are shown as
`[EXPOSURE]`. The underlying JSONL status remains unchanged.
A timeout is not evidence that a target is patched. A version fingerprint
does not prove appliance model, relevant present or historical VPN
configuration, or exploitability.
## Offline validation
```sh
python3 -m unittest discover -s tests -v
python3 tests/benchmark_offline.py
python3 wg_ike_mass_scanner.py --default-range --dry-run
sha256sum -c MANIFEST.sha256
```
The GitHub Actions workflow performs only offline unit tests, a dry run,
manifest verification, and a reduced offline benchmark.
## Security and scope
Use this project only on systems you own or are explicitly authorized to
assess. See [SECURITY.md](SECURITY.md) for the reporting and data-handling
boundary.
## License status
No open-source license is included in this upload package. See
[LICENSE-STATUS.md](LICENSE-STATUS.md) before publishing or redistributing it.
## References
- [WatchGuard advisory WGSA-2025-00015](https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015)
- [NVD CVE-2025-9242](https://nvd.nist.gov/vuln/detail/CVE-2025-9242)
- RFC 7296: Internet Key Exchange Protocol Version 2
- RFC 3948: UDP Encapsulation of IPsec ESP Packets