An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may

CVE-2025-14733 is an out-of-bounds write (CWE-787) in the iked process of WatchGuard Fireware OS — the IKE daemon responsible for negotiating, authenticating, and managing IKEv2 VPN tunnels on Firebox firewall appliances. By sending a specially crafted IKE_AUTH request containing an oversized certificate chain (>8 certificates or CERT payloads >2,000 bytes), an unauthenticated remote attacker triggers a buffer overflow that leads to arbitrary code execution as root on the appliance. Affected versions span Fireware OS 11.x through 11.12.4_Update1, all 12.x releases up to 12.11.5, and 2025.1 through 2025.1.3. Any Firebox with IKEv2 mobile user VPN, branch office VPN to a dynamic peer, or even *residual* IKEv2 configuration from a deleted tunnel is vulnerable. Fixed in 2025.1.4, 12.11.6, 12.5.15 (T15/T35), and 12.3.1_Update4 (FIPS).

WatchGuard's CRITICAL 9.8 rating is entirely accurate and arguably conservative. This is an unauthenticated, no-interaction, network-reachable RCE on a perimeter firewall appliance — the single worst class of vulnerability that exists. Shadowserver identified 117,490+ exposed and unpatched Firebox devices within days of disclosure. CISA added it to KEV on December 19, 2025 — the same day as disclosure — with a federal remediation deadline of December 26. Post-exploitation activity already documented in the wild includes configuration file theft, credential database exfiltration, and linkage to ransomware operations. There is zero friction in the attack path: the target service (UDP 500/4500) is internet-facing by design on every Firebox running VPN.

Why this verdict

• Zero authentication friction: The attack requires no credentials, no user interaction, and targets a service (IKEv2 on UDP 500/4500) that is internet-facing by design. There is no prerequisite that implies prior compromise.
• Role multiplier: WatchGuard Firebox is a network edge appliance — it occupies the high-value perimeter role by definition. 100% of deployments place this device at the network boundary. Compromise yields root on the firewall → full network topology exposure → credential theft (VPN PSKs, LDAP bind creds, RADIUS secrets) → lateral movement into the entire protected network. Blast radius is fleet-scale when credentials are reused or LDAP/RADIUS backends serve the broader enterprise.
• KEV-listed with active exploitation: CISA added this to KEV on the same day as public disclosure with a 7-day federal remediation deadline — one of the most aggressive timelines CISA has ever set. Post-exploitation activity (config theft, credential DB exfiltration) is documented with IOC IPs.
• Massive exposure population: 117,490+ unpatched devices confirmed internet-facing by Shadowserver. This is not a niche product — WatchGuard has significant SMB and mid-enterprise market share.
• Ransomware linkage: Multiple sources report this vulnerability is being exploited in ransomware campaigns, confirming the chain extends beyond initial access to full organizational impact.

Why not higher?

There is no severity above CRITICAL (9.8 is the maximum practical score for a network-facing unauthenticated RCE). The CVSS vector already maxes out every relevant metric.

Why not lower?

Every downgrade factor is absent: the attack is unauthenticated (no credential prerequisite), the target service is internet-facing by design (no "requires internal access" narrowing), the affected population is enormous (117K+), exploitation is confirmed active with ransomware linkage, and the component is a canonical high-value network edge appliance. Downgrading below CRITICAL would require evidence that the attack chain fails reliably in practice — the opposite is documented.

1. Patch immediately — deploy Fireware 2025.1.4, 12.11.6, 12.5.15, or 12.3.1_Update4 — This is the only complete fix. Given KEV listing and active exploitation, deploy within hours, not days. The noisgate mitigation SLA for CRITICAL is ≤3 days, but active exploitation overrides this to immediate.
2. Disable IKEv2 VPN if not actively required — If you can temporarily fall back to IKEv1 or SSL VPN (SSLVPN on Firebox), disabling IKEv2 removes the attack surface entirely. This is a same-day emergency change if patching requires a maintenance window.
3. Rotate all credentials stored on the Firebox — Post-exploitation involves config and credential database exfiltration. Rotate VPN pre-shared keys, LDAP bind passwords, RADIUS shared secrets, and local management user passwords on ALL Firebox appliances — even those you believe were not compromised. Do this within 3 days per the noisgate mitigation SLA.
4. Block known IOC IPs at upstream perimeter — Block 45.95.19[.]50, 51.15.17[.]89, 172.93.107[.]67, 199.247.7[.]82, 38.252.8[.]14, 94.249.197[.]106 at your upstream router or ISP-level ACL. This is a stopgap — attackers will rotate infrastructure.
5. Monitor for iked process crashes and anomalous outbound connections from Firebox management IPs — Failed exploitation attempts cause iked hangs/crashes. Successful exploitation generates outbound data exfiltration from the firewall itself. Alert on both patterns in your SIEM. Deploy within 3 days.
6. Audit Firebox configurations for residual IKEv2 settings — Even deleted IKEv2 mobile user VPN or dynamic-peer BOVPN configurations can leave the appliance vulnerable if a static-peer BOVPN remains. Audit and clean up residual configs on all appliances.

Run this script on each Firebox appliance via SSH (or from your Firebox management server if using WatchGuard System Manager CLI). Requires admin SSH access to the appliance. Example: ssh admin@<firebox-ip> 'show sysinfo' to test connectivity first, then run the script.

#!/bin/bash
# CVE-2025-14733 Vulnerability Check for WatchGuard Firebox
# Run on: Firebox appliance via SSH or management workstation with SSH access
# Requires: admin-level SSH access to the Firebox
# Usage: bash check_cve_2025_14733.sh <firebox_ip>

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <firebox_ip_or_hostname>"
  exit 3
fi

FIREBOX="$1"

# Get firmware version from the Firebox
VERSION=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "admin@${FIREBOX}" 'show sysinfo' 2>/dev/null | grep -i 'firmware' | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' || echo "UNKNOWN")

if [ "$VERSION" = "UNKNOWN" ]; then
  echo "UNKNOWN - Could not retrieve firmware version from ${FIREBOX}"
  exit 2
fi

echo "Detected Fireware OS version: ${VERSION}"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

VULNERABLE=false

# Check version ranges
# 2025.1.x: vulnerable if < 2025.1.4
if [ "$MAJOR" -eq 2025 ] && [ "$MINOR" -eq 1 ]; then
  if [ "$PATCH" -lt 4 ]; then
    VULNERABLE=true
  fi
# 12.11.x: vulnerable if < 12.11.6
elif [ "$MAJOR" -eq 12 ] && [ "$MINOR" -eq 11 ]; then
  if [ "$PATCH" -lt 6 ]; then
    VULNERABLE=true
  fi
# 12.5.x (T15/T35): vulnerable if < 12.5.15
elif [ "$MAJOR" -eq 12 ] && [ "$MINOR" -eq 5 ]; then
  if [ "$PATCH" -lt 15 ]; then
    VULNERABLE=true
  fi
# 12.x where minor < 5 or between 6-10: all vulnerable (no fix for these branches)
elif [ "$MAJOR" -eq 12 ]; then
  VULNERABLE=true
# 11.x: all vulnerable (EOL, no patch)
elif [ "$MAJOR" -le 11 ]; then
  VULNERABLE=true
fi

if [ "$VULNERABLE" = true ]; then
  echo "VULNERABLE - Fireware OS ${VERSION} is affected by CVE-2025-14733"
  exit 1
else
  echo "PATCHED - Fireware OS ${VERSION} includes the fix for CVE-2025-14733"
  exit 0
fi

Sources

1. WatchGuard PSIRT Advisory
2. CISA KEV Listing
3. Help Net Security — WatchGuard Firebox Under Attack
4. Horizon3.ai Technical Analysis
5. Arctic Wolf Advisory
6. The Hacker News Coverage
7. SOC Prime Detection Content
8. Kudelski Security Research