Article
Five edge VPN flaws CISA flags for ransomware use
Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check…
Read more
Exploited vulnerability
WatchGuard Firebox iked out-of-bounds write (CVE-2025-14733)
CVE-2025-14733
CVE-2025-14733 is an out-of-bounds write in the iked process of WatchGuard Fireware OS, the software of Firebox firewalls.
- On CISA KEV
- CVE ID
- CVE-2025-14733
- CISA KEV
- Listed
- Affected product
- Fireware OS on Firebox
- Exploited
- Yes
- Published
- December 2025
In short
CVE-2025-14733 is an out-of-bounds write in the iked process of WatchGuard Fireware OS, the software of Firebox firewalls. iked handles IKEv2, the key exchange used to set up IPsec VPN tunnels. A write outside its memory space can let an attacker run code. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-14733
- ProductWatchGuard Fireware OS on Firebox
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade Fireware OS · Rotate stored secrets
What it allows
A remote attacker with no account can run code on the firewall. It affects the mobile user VPN with IKEv2 and the branch office VPN with IKEv2 when set up with a dynamic gateway peer. WatchGuard scores it 9.3 (CVSS v4.0, critical). NVD also lists 9.8 (CVSS v3.1).
Who is affected
Per WatchGuard: Fireware OS 2025.1 before 2025.1.4, 12.0 before 12.11.6 and 11.10.2 up to 11.12.4+541730. Firebox T15 and T35 on 12.0 before 12.5.15. FIPS builds before 12.3.1+728352. A Firebox that once had these VPNs and had them deleted may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
WatchGuard published its advisory and CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 19 December 2025, with a due date of 26 December 2025. The KEV entry flags known use in ransomware campaigns. WatchGuard says it has observed threat actors actively trying to exploit the flaw in the wild. It does not give the date of the first attack.
WatchGuard describes two kinds of activity after a successful attack. In one, the attacker encrypts the active configuration file and sends it out to the same IP address the attack came from. In the other, the attacker also bundles the local management user database into a gzip archive and sends it to the same address. The advisory lists attacker IP addresses and added two on 29 December.
The official sources opened (WatchGuard, NVD, CISA) do not name who exploited the flaw, so this page does not attribute it to any group.
What to do
-
Upgrade Fireware OS
WatchGuard names Fireware OS 2025.1.4, 12.11.6, 12.5.15 (T15 and T35) and 12.3.1-b728352 (FIPS).
-
Rotate stored secrets
If an attack is suspected, WatchGuard says to rotate all secrets stored on the Firebox after patching. The attacker takes the configuration file, which holds them.
-
Use the workaround if you cannot patch
For devices with only branch office VPNs to static gateway peers, WatchGuard points to its recommendations for securing IPsec and IKEv2 branch office VPNs as a temporary measure.
-
Detect and hunt
Look for an IKE_AUTH request with a CERT payload above 2000 bytes (strong sign, info log level), the log line "Received peer certificate chain is longer than 8" (medium sign), an iked process that hangs (strong) or crashes (weak). Block and review traffic to and from the listed IP addresses.
Questions
What is CVE-2025-14733?
It is an out-of-bounds write in the iked process of WatchGuard Fireware OS on Firebox firewalls. iked handles IKEv2, the key exchange for IPsec VPN tunnels. A remote attacker with no account can run code on the firewall.
Which WatchGuard Firebox VPN setups are affected?
The mobile user VPN with IKEv2 and the branch office VPN with IKEv2 set up with a dynamic gateway peer. A Firebox that once had these VPNs deleted may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
What should I do after patching CVE-2025-14733?
Upgrade to Fireware OS 2025.1.4, 12.11.6, 12.5.15 for T15 and T35, or 12.3.1-b728352 for FIPS builds. If an attack is suspected, WatchGuard says to rotate all secrets stored on the Firebox, because the attacker takes the configuration file that holds them.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.