WatchGuard Fireware OS iked IKEv2 Pre-Authentication Out-of-Bounds Write RCE

#!/usr/bin/env bash
# CVE-2025-14733 WatchGuard Firebox Version Checker
# Checks if a WatchGuard Firebox is running a vulnerable Fireware OS version.
# Usage: bash check_cve_2025_14733.sh <FIREBOX_IP>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <FIREBOX_IP_OR_HOSTNAME>"
  exit 2
fi

TARGET="$1"
TIMEOUT=10

# Attempt to grab version from the Firebox web UI login page
VERSION_RAW=$(curl -sk --connect-timeout "$TIMEOUT" \
  "https://${TARGET}:8080/" 2>/dev/null \
  | grep -oP 'Fireware[\s_]*(v|OS\s*v?)?\K[0-9]+\.[0-9]+\.[0-9]+[_a-zA-Z0-9]*' \
  || true)

# Fallback: try port 4117
if [ -z "$VERSION_RAW" ]; then
  VERSION_RAW=$(curl -sk --connect-timeout "$TIMEOUT" \
    "https://${TARGET}:4117/" 2>/dev/null \
    | grep -oP 'Fireware[\s_]*(v|OS\s*v?)?\K[0-9]+\.[0-9]+\.[0-9]+[_a-zA-Z0-9]*' \
    || true)
fi

if [ -z "$VERSION_RAW" ]; then
  echo "UNKNOWN - Could not detect Fireware version on ${TARGET}."
  echo "Verify the target is a WatchGuard Firebox and management ports (8080/4117) are reachable."
  echo "Manual check: log into Firebox System Manager and note the Fireware OS version."
  exit 2
fi

echo "Detected Fireware version: ${VERSION_RAW}"

# Extract major.minor.patch
MAJOR=$(echo "$VERSION_RAW" | cut -d. -f1)
MINOR=$(echo "$VERSION_RAW" | cut -d. -f2)
PATCH=$(echo "$VERSION_RAW" | cut -d. -f3 | sed 's/[^0-9].*//')

# Version comparison logic
# Vulnerable: 11.10.2 - 11.12.4 (EOL, no patch)
#             12.0.0 - 12.11.5
#             2025.1.0 - 2025.1.3
# Patched:    >= 12.11.6, >= 12.5.15 (T15/T35), >= 2025.1.4

VULNERABLE=false

if [ "$MAJOR" -eq 11 ]; then
  echo "WARNING: Fireware 11.x is END-OF-LIFE with no available patch."
  VULNERABLE=true
elif [ "$MAJOR" -eq 12 ]; then
  if [ "$MINOR" -lt 11 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 11 ] && [ "$PATCH" -le 5 ]; then
    VULNERABLE=true
  elif [ "$MINOR" -eq 5 ] && [ "$PATCH" -le 14 ]; then
    # T15/T35 12.5.x branch
    VULNERABLE=true
  fi
elif [ "$MAJOR" -eq 2025 ]; then
  if [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 3 ]; then
    VULNERABLE=true
  fi
fi

if [ "$VULNERABLE" = true ]; then
  echo "VULNERABLE - Fireware ${VERSION_RAW} is affected by CVE-2025-14733."
  echo "Action: Upgrade immediately to 2025.1.4, 12.11.6, or 12.5.15 (T15/T35)."
  if [ "$MAJOR" -eq 11 ]; then
    echo "CRITICAL: Version 11.x is EOL. No patch available. Replace hardware."
  fi
  exit 1
else
  echo "PATCHED - Fireware ${VERSION_RAW} is not affected by CVE-2025-14733."
  exit 0
fi