Reported by 12 outlets
CISA Confirms WatchGuard Firebox RCE CVE-2025-14733 Is Being Exploited in Ransomware Attacks
Why this score
- Breadth
- 2.00 / 2.0 · 12 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2025-14733 is an out-of-bounds write in the iked process of WatchGuard Fireware OS, scored 9.3 on CVSS v4.0, exploitable by an unauthenticated remote attacker who can reach the device's IKEv2 service. WatchGuard published advisory WGSA-2025-00027 on 2025-12-19 with fixes in Fireware OS 2025.1.4, 12.11.6, 12.5.15 for T15/T35 appliances, and 12.3.1-b728352 for FIPS builds. CISA added the bug to its KEV catalog the same day with a 2025-12-26 federal remediation deadline, and its 2026-09-10 update states the flaw is now used in ransomware attacks. WatchGuard's advisory documents two post-exploit variants: encryption and exfiltration of the active configuration to the attacker's own source IP, and exfiltration of a gzip archive holding the configuration plus the local management user database. Exposure requires IKEv2 Mobile User VPN or branch office IKEv2 with a dynamic gateway peer, and a device whose IKEv2 configuration was deleted can remain vulnerable if a branch office VPN to a static gateway peer is still configured.
The nine-month gap between patch and ransomware is the story. Shadowserver counted roughly 125,000 exposed Firebox addresses when the campaign was first tracked, and about 9,000 devices remain unpatched, so the residual pool is small, finite, and already enumerated by anyone running the same scans. What the timeline does not spell out is the credential debt: any Firebox exploited before patching handed over the local management user database, meaning admin passwords, VPN pre-shared keys, and certificates left the building regardless of patch status, and installing the fix does not recover them. This bug also targets the same iked IKEv2 code path as CVE-2025-9242, KEV-listed in November 2025, and advisory IP 199.247.7[.]82 overlapped with infrastructure Arctic Wolf tied to Fortinet exploitation, evidence that the same actors recycle access tooling across edge platforms. WatchGuard VPN endpoints are a standing target population, not a one-off incident.
Update to Fireware OS 2025.1.4 or 12.11.6 on general branches, 12.5.15 on T15/T35, and 12.3.1-b728352 on FIPS, then audit whether the device ever held IKEv2 mobile user or dynamic-peer branch office configurations rather than trusting current settings. Devices that only terminate static-peer branch office VPNs and cannot patch yet can apply WatchGuard's secure-access guidance for IPSec/IKEv2 branch office VPNs as a temporary control. The hunt runs in iked diagnostic logs: at the default error level, "Received peer certificate chain is longer than 8" is a medium-confidence indicator of attack; at info level, an IKE_AUTH request carrying a CERT payload above 2000 bytes is a strong indicator. Treat iked hang as a strong indicator and crash with fault report as a weak one, and pull traffic logs for outbound connections from the appliance itself to 45.95.19[.]50, 51.15.17[.]89, 172.93.107[.]67, 199.247.7[.]82, 38.252.8[.]14, or 94.249.197[.]106, where outbound is a strong compromise signal and inbound only marks attempt activity. Any suspected victim rotates every secret stored on the Firebox per WatchGuard's shared-secret rotation procedure, then aligns settings on peer devices.
Two developments would move the assessment. Attribution: CISA's ransomware designation names no family and no victims, and a named group with published tradecraft would separate targeted campaigns from opportunistic scanning of the residual unpatched pool. Tooling: no public exploit is confirmed, and proof-of-concept code reliable against the static-peer residual configuration case, or a further KEV revision broadening the victim description, would signal the exploitation window is widening rather than closing.
Timeline
-
original reporting
CISA confirmed CVE-2025-14733, a critical WatchGuard Firebox RCE, is being exploited in ransomware attacks. Edge firewalls are high-value ta
cyberworldops.eu · 33d ago · September 10th, 2026
CISA confirmed CVE-2025-14733, a critical WatchGuard Firebox RCE, is being exploited in ransomware attacks. Edge firewalls are high-value ta
via Mastodon https://cyberworldops.eu/en/cisa-confirms-watchguard-firebox-rce-is-being-used-in-ransomware
-
update from watchguard.com
WatchGuard Firebox iked Out of Bounds Write Vulnerability (CVE-2025-9242)
watchguard.com · 392d ago · September 17th, 2025
Vendor advisory published 2025-09-17 and updated 2026-08-10 for an out-of-bounds write in the Fireware OS iked process, scored 9.3 on CVSS v4.0, reachable pre-authentication through Mobile User VPN or Branch Office VPN IKEv2 with a dynamic gateway peer, and still exposing devices where a branch office VPN to a static gateway peer remains configured. WatchGuard stated it had evidence of active exploitation. Fixes shipped in Fireware OS 2025.1.1, 12.11.4, 12.5.13 for T15/T35 models, and 12.3.1+722811 for FIPS, with an IoA of IKE_AUTH IDi payloads larger than 100 bytes.
-
update from watchtowr.com
yIKEs (WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242)
watchtowr.com · 363d ago · October 16th, 2025
Original researcher analysis by McCaulay Hudson, published 2025-10-16. Patch diffing Fireware 12.11.3 against 12.11.4 located the flaw in ike2_ProcessPayload_CERT, which copies the attacker-controlled IKEv2 Identification payload into a 520-byte stack buffer before certificate validation. The post demonstrates unauthenticated version fingerprinting via a custom Vendor ID payload, RIP control, and an mprotect ROP chain yielding a root Python reverse TCP shell, and ships a detection artifact generator on GitHub.
-
update from securityaffairs.com
A critical WatchGuard Fireware flaw could allow unauthenticated code execution
securityaffairs.com · 362d ago · October 17th, 2025
Coverage of the watchTowr analysis published 2025-10-17. Reports CVE-2025-9242 at CVSS 9.3 affecting Fireware OS 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.3, and 2025.1, and quotes WatchGuard's fix table of 2025.1.1, 12.11.4, 12.5.13, and 12.3.1_Update3 (B722811), with 11.x flagged end of life. Frames pre-authentication RCE on an internet-exposed IKEv2 service as exactly the profile ransomware operators seek.
-
update from cisa.gov
CISA Known Exploited Vulnerabilities catalog entry for CVE-2025-9242
cisa.gov · 336d ago · November 12th, 2025
CISA added CVE-2025-9242 to the Known Exploited Vulnerabilities catalog on 2025-11-12, giving federal agencies a 2025-12-03 remediation deadline under BOD 22-01. The catalog entry carries knownRansomwareCampaignUse set to Unknown and references WatchGuard advisory WGSA-2025-00015.
-
update from watchguard.com
WatchGuard Firebox iked Out of Bounds Write Vulnerability (CVE-2025-14733)
watchguard.com · 299d ago · December 19th, 2025
WatchGuard reported observing active exploitation in the wild and documented two post-exploit variants that encrypt and exfiltrate the active configuration, one together with the local management user database. Fixes shipped in Fireware OS 2025.1.4, 12.11.6, 12.5.15 for T15/T35, and 12.3.1-b728352 for FIPS, with IoAs covering IKE_AUTH CERT payloads above 2000 bytes, peer certificate chains longer than 8, iked hang and crash, and six threat-actor IP addresses.
-
mentioned by cisa.gov
CISA Known Exploited Vulnerabilities catalog entry for CVE-2025-14733
cisa.gov · 299d ago · December 19th, 2025
-
update from securityaffairs.com
U.S. CISA adds a flaw in WatchGuard Fireware OS to its Known Exploited Vulnerabilities catalog
securityaffairs.com · 298d ago · December 20th, 2025
First-wave news coverage of the KEV addition, published 2025-12-20. Reports the affected Fireware branches 11.10.2 through 11.12.4_Update1, 12.0 through 12.11.5, and 2025.1 through 2025.1.3, the December 26 federal deadline, and WatchGuard's guidance to rotate all locally stored secrets on suspect devices. Notes that advisory IP 199.247.7[.]82 was flagged by Arctic Wolf the same week in exploitation of Fortinet CVE-2025-59718 and CVE-2025-59719.
-
update from bleepingcomputer.com
Critical RCE flaw impacts over 115,000 WatchGuard firewalls
bleepingcomputer.com · 296d ago · December 22nd, 2025
Telemetry reporting published 2025-12-22. Shadowserver counted 124,658 unpatched, internet-exposed Firebox instances on December 20 and 117,490 a day later. The article details WatchGuard's workaround for devices that cannot patch immediately, disabling dynamic peer BOVPNs, adding restrictive firewall policies, and disabling the default system policies that handle VPN traffic, and recaps sibling bug CVE-2025-9242, for which Shadowserver had found over 75,000 vulnerable devices.
-
update from bleepingcomputer.com
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
bleepingcomputer.com · 33d ago · September 10th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December. This flaw is tracked as CVE-2025-14733 and stems from an out-of-bounds write allowing unauthenticated threat actors to execute malicious code remotely in low-complexity attacks. When it released CVE-2025-14733 security patches in December, WatchGuard said unpatched Firebox firewalls are vulnerable to attacks only if configured to use IKEv2 VPN, but noted they might still be compromised even if the vulnerable configurations have been deleted if a branch office VPN to a static gateway peer is still configured. WatchGuard also confirmed that attackers were exploiting the flaw in the wild and shared indicators of compromise to help customers check whether their Firebox devices have been hacked. Internet security watchdog group Shadowserver found over 115,00 unpatched Firebox firewalls exposed online in December, and nearly 9,000 instances remain unsecured after nine months.
-
update from www.bleepingcomputer.com
CISA: WatchGuard RCE flaw now exploited in ransomware attacks https:// bleepingcomputer.com/news/security/ cisa-watchguard-rce-flaw-now-expl
www.bleepingcomputer.com · 33d ago · September 10th, 2026
CISA: WatchGuard RCE flaw now exploited in ransomware attacks https:// bleepingcomputer.com/news/security/ cisa-watchguard-rce-flaw-now-expl
via X https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/
-
mentioned by www.bleepingcomputer.com
🤖 CISA: ransomware gangs now exploiting CVE-2025-9242, a critical RCE in WatchGuard Firebox firewalls. Added to CISA KEV in December — patch
www.bleepingcomputer.com · 33d ago · September 10th, 2026
-
mentioned by osintsights.com
Ransomware gangs exploit WatchGuard firewall flaw Ransomware gangs are exploiting a critical vulnerability in WatchGuard Firebox firewalls,
osintsights.com · 33d ago · September 10th, 2026
-
mentioned by www.bleepingcomputer.com
"CISA: WatchGuard RCE flaw now exploited in ransomware attacks" "[...] Cybersecurity and Infrastructure Security Agency (CISA) has confirmed
www.bleepingcomputer.com · 33d ago · September 10th, 2026
-
update from tugatech.com.pt
Ransomware groups are exploiting a critical vulnerability in WatchGuard Firebox firewalls, allowing malicious code execution
tugatech.com.pt · 33d ago · September 10th, 2026
Ransomware groups are exploiting a critical vulnerability in WatchGuard Firebox firewalls, allowing malicious code execution
via Mastodon https://tugatech.com.pt/t90760-firewalls-da-watchguard-sob-ataque-de-grupos-de-ransomware-devido-a-falha-critica
-
mentioned by radar.offseq.com
CVE-2025-14733: CRITICAL RCE in WatchGuard Firebox (Fireware OS 11.x+, 12.x+, 2025.1 – 2025.1.3) exploited by ransomware. Patch ASAP! Review
radar.offseq.com · 33d ago · September 10th, 2026
-
mentioned by dev.to
WatchGuard Firebox CVE-2025-14733: Unauthenticated RCE via IKEv2 and Ransomware Exploitation # security # threatintel # software # coding #
dev.to · 32d ago · September 11th, 2026
-
mentioned by www.bleepingcomputer.com
CISA: # WatchGuard RCE flaw now exploited in # ransomware attacks https://www. bleepingcomputer.com/news/secu rity/cisa-watchguard-rce-flaw-
www.bleepingcomputer.com · 31d ago · September 12th, 2026
-
mentioned by cybertop.ai
CYBERTOP's AI detected CVE-2025-14733: WatchGuard Firebox out of bounds write vulnerability actively exploited. Update immediately to patch
cybertop.ai · 30d ago · September 13th, 2026
-
mentioned by diesec.com
CVE-2025-14733 (CVSS 9.3): WatchGuard Firebox RCE patched since Dec 2025, now confirmed under ransomware exploitation. ~125K IPs exposed, ~9
diesec.com · 20d ago · September 23rd, 2026