CVE-2025-14733

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 11.10.2 through 11.12.4 Update1 WatchGuard Fireware OS versions 12.0 through 12.11.5 WatchGuard Fireware OS versions 2025.1 through 2025.1.3

Description An out-of-bounds write vulnerability exists in the iked process of WatchGuard Fireware OS. This allows a remote, unauthenticated attacker to execute arbitrary code. The vulnerability affects both Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability is actively being exploited in the wild, with over 115,000 to 125,000 devices potentially exposed. Attackers are utilizing this flaw to gain unauthorized access and execute code on affected firewalls, potentially compromising network security and leading to data breaches. The vulnerability has been assigned CVE-2025-14733 and has a CVSS score of 9.3. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

Recommendations WatchGuard Fireware OS versions 11.10.2 through 11.12.4 Update1: Apply the latest security updates provided by WatchGuard. WatchGuard Fireware OS versions 12.0 through 12.11.5: Apply the latest security updates provided by WatchGuard. WatchGuard Fireware OS versions 2025.1 through 2025.1.3: Apply the latest security updates provided by WatchGuard.