Critical RCE Vulnerability CVE-2025-14733 Affects Over 115,000 WatchGuard Firewalls
- Securityish
- Threats & Incidents
Quick Summary
A critical remote code execution vulnerability, tracked as CVE-2025-14733, affects over 115,000 WatchGuard Firebox devices. This flaw allows unauthenticated attackers to execute arbitrary code remotely, particularly impacting devices running Fireware OS 11.x and later. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch affected devices by December 26, 2025, due to the significant risks posed by this vulnerability.
The Securityish Brief
Over 115,000 WatchGuard Firebox devices are vulnerable to a critical remote code execution (RCE) flaw identified as CVE-2025-14733. This vulnerability affects devices running Fireware OS 11.x and later, including versions 11.12.4_Update1, 12.x or later, and 2025.1 up to 2025.1.3. Exploitation of this flaw allows unauthenticated attackers to execute arbitrary code remotely without user interaction, posing severe risks to network security.
WatchGuard disclosed the vulnerability in an advisory, noting that unpatched devices are only vulnerable if configured for IKEv2 VPN. The advisory also highlighted that even if vulnerable configurations are removed, risks remain if a Branch Office VPN (BOVPN) to a static gateway peer is still in place. This underscores the importance of proper configuration management in mitigating risks.
On December 19, 2025, CISA added CVE-2025-14733 to its Known Exploited Vulnerabilities Catalog and mandated that federal agencies patch their Firebox firewalls by December 26, 2025, as per Binding Operational Directive 22-01. This directive emphasizes the urgency of addressing vulnerabilities that can be exploited by malicious actors.
In a similar incident, WatchGuard had previously patched a related RCE vulnerability, CVE-2025-9242, in September 2025, which also affected Firebox firewalls. This pattern of vulnerabilities highlights ongoing security challenges faced by organizations using WatchGuard products.
Organizations should take immediate action to secure their networks by applying the necessary patches and monitoring for signs of compromise. WatchGuard has provided indicators of compromise to assist customers in identifying affected devices.
Understanding the Risks
This incident illustrates the significant risks posed by unpatched vulnerabilities in widely used security devices. Organizations relying on WatchGuard Firebox appliances must prioritize timely updates and configuration reviews to mitigate potential threats.
Users and organizations should remain vigilant for unusual network activity and ensure that all security devices are configured according to best practices. Regular audits and updates can help prevent exploitation of known vulnerabilities.
Key Takeaways
- Check if your WatchGuard Firebox devices are running affected versions of Fireware OS and apply the latest patches immediately.
- Review your VPN configurations to ensure they do not expose your devices to unnecessary risks.
- Monitor your network for indicators of compromise related to CVE-2025-14733 and take action if any signs of malicious activity are detected.
- Follow CISA’s guidance regarding the patching of vulnerabilities and ensure compliance with Binding Operational Directive 22-01.
- Regularly audit your network security practices to identify and mitigate potential vulnerabilities in your systems.
Key Terms & Concepts
- CVE-2025-14733: In this article, CVE-2025-14733 refers to a critical remote code execution vulnerability affecting WatchGuard Firebox devices.
- RCE: RCE stands for remote code execution, which allows attackers to run arbitrary code on a target device from a remote location.
- IKEv2: IKEv2 is a protocol used to set up a security association in the IPsec protocol suite, often used for VPN connections.
- BOVPN: BOVPN stands for Branch Office Virtual Private Network, which connects remote offices to a central network securely.
- CISA: CISA refers to the Cybersecurity and Infrastructure Security Agency, a U.S. government agency responsible for protecting the nation’s critical infrastructure.
Read the original article here: https://www.bleepingcomputer.com/news/security/over-115-000-watchguard-firewalls-vulnerable-to-ongoing-rce-attacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
