Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-14733 9.8
WatchGuard · Firebox · Added 2025-12-19 · Published 2025-12-19
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityWatchGuard Firebox Out of Bounds Write Vulnerability
VendorWatchGuard
ProductFirebox
Date added2025-12-19
Due date2025-12-26
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-787
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

NVD: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-29 09:44 UTC
Searches5
Component defaultyes
Sources https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027
https://nvd.nist.gov/vuln/detail/CVE-2025-14733
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://horizon3.ai/attack-research/vulnerabilities/cve-2025-14733/
https://www.sprocketsecurity.com/blog/emerging-watchguard-vulnerability-what-we-know-about-cve-2025-14733
https://www.bleepingcomputer.com/news/security/over-115-000-watchguard-firewalls-vulnerable-to-ongoing-rce-attacks/
https://socprime.com/blog/cve-2025-14733-vulnerability/
https://socradar.io/blog/cve-2025-14733-watchguard-firebox-rce-flaw/
https://www.helpnetsecurity.com/2025/12/22/watchguard-firebox-vulnerability-cve-2025-14733/
https://fieldeffect.com/blog/active-exploitation-critical-firebox-rce-flaw
https://kudelskisecurity.com/research/critical-ikev2-vpn-vulnerability-in-watchguard-fireware-os---cve-2025-14733
https://www.cisecurity.org/advisory/a-vulnerability-in-watchguard-fireware-os-could-allow-for-arbitrary-code-execution_2025-118

Hunting hypothesis agent

Hunt for IKE_AUTH requests to WatchGuard Firebox UDP 500/4500 with oversized CERT payloads (>2000 bytes or >8 certificates) and correlate with iked crashes; IoC IPs include 45.95.19.50 and 172.93.107.67.

Research details

Componentiked (IKE daemon) certificate processing in IKEv2 IKE_AUTH message handling on UDP ports 500/4500
PreconditionsNetwork reachability to UDP ports 500 or 4500 (IKEv2) on a WatchGuard Firebox appliance; The device must run a vulnerable Fireware OS version: 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.5, or 2025.1 through 2025.1.3; Mobile User VPN with IKEv2 or Branch Office VPN (BOVPN) using IKEv2 must be configured (including dynamic gateway peer); No authentication required — the attacker sends a single crafted IKE_AUTH request with an oversized CERT payload over UDP; Over 115,000 exposed Firebox devices were estimated vulnerable at disclosure (BleepingComputer, Dec 2025); Actively exploited in the wild by threat actors targeting edge networking infrastructure. agent
DeliveryA single crafted IKE_AUTH request sent over UDP port 500 or 4500 containing an abnormally large CERT payload (certificate chain exceeding ~2000 bytes or more than 8 certificates) triggers an out-of-bounds stack write in the iked daemon's certificate processing logic, enabling arbitrary code execution without authentication.
Public PoCno
Advisoryhttps://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027
Exploit notesCVSS attack complexity: LOW | CVSS 4.0 score: 9.3 (CRITICAL) | No workaround short of patching. The root cause is an unchecked memory copy of certificate data into a stack buffer during IKE_AUTH processing in the iked daemon (Sprocket Security binary analysis). A single crafted IKEv2 packet with an oversized CERT payload triggers the out-of-bounds write. WatchGuard confirmed active exploitation with post-exploitation activity identified. IoCs: IPs 45.95.19.50, 51.15.17.89, 172.93.107.67, 199.247.7.82, 38.252.8.14, 94.249.197.106. WatchGuard diagnostic logging shows 'Invalid peer certificate chain' for exploitation attempts. Sprocket Security and WatchTowr confirmed the root cause is similar to CVE-2025-9242 (same iked code path family, different trigger). Stack canaries added in 12.11.4 partially mitigate impact. Detection-only PoCs exist (fankh/vulnerability-poc, machevalia/CVE-2025-14733) but no public weaponized exploit code.
SummaryCritical out-of-bounds write vulnerability in WatchGuard Fireware OS iked (IKE daemon) allows remote unauthenticated attackers to execute arbitrary code via crafted IKEv2 IKE_AUTH packets with oversized CERT payloads sent to UDP ports 500 or 4500. Affects Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 with dynamic gateway peer configuration on Firebox devices running Fireware OS 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.5, and 2025.1 through 2025.1.3. The root cause is an unchecked stack buffer copy of certificate data during IKE_AUTH message processing. WatchGuard confirmed active exploitation in the wild with post-exploitation activity and published 6 IoC IP addresses. The vulnerability is related to CVE-2025-9242 (same iked code path family). No workaround available; resolved in Fireware OS 2025.1.4, 12.11.6, 12.5.15, and 12.3.1_Update4. Over 117,000 devices initially exposed per Shodan/Censys. Added to CISA KEV on December 19, 2025.

Tia coverage

First reported2025-09-17
First exploit report2026-09-10
Exploit report → KEV265 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-confirms-watchguard-firebox-rce-cve-2025-14733-is-being-exp

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub