WatchGuard Issues Warning Over Active Exploitation of CVE-2025-14733 Vulnerability
- Securityish
- Threats & Incidents
Quick Summary
WatchGuard has identified active exploitation of a critical vulnerability in Fireware OS, tracked as CVE-2025-14733, with a CVSS score of 9.3. This out-of-bounds write flaw affects both mobile user VPN and branch office VPN configurations using IKEv2. Users are urged to apply fixes immediately to protect against unauthorized remote code execution.
The Securityish Brief
WatchGuard has reported that a critical vulnerability in its Fireware OS, identified as CVE-2025-14733, is being actively exploited in the wild. This vulnerability, which has a CVSS score of 9.3, allows remote unauthenticated attackers to execute arbitrary code through an out-of-bounds write affecting the iked process. It impacts Fireware OS versions 2025.1, 12.x, 12.5.x, 12.3.1, and 11.x, with specific fixes provided for each version.
The vulnerability primarily affects configurations using IKEv2 for mobile user VPNs and branch office VPNs. Even if certain configurations have been deleted, devices may still be vulnerable if a static gateway peer is configured. WatchGuard has noted that threat actors are actively attempting to exploit this flaw, with attacks originating from specific IP addresses.
Indicators of compromise (IoCs) have been shared by WatchGuard, including specific log messages that indicate potential exploitation attempts. For instance, if a log message states that the peer certificate chain is longer than eight, this may signal an attack. Additionally, abnormal payload sizes in IKE_AUTH requests and crashes of the iked process are also signs of exploitation.
This vulnerability disclosure follows a recent addition of another critical flaw in WatchGuard Fireware OS to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. While it remains unclear if these two vulnerabilities are related, the urgency for users to apply updates is emphasized.
Organizations using WatchGuard Fireware OS should take immediate action to secure their systems against this vulnerability. The potential for unauthorized code execution poses significant risks to network security and data integrity.
Key Takeaways
- Immediately apply the latest updates for Fireware OS to mitigate the CVE-2025-14733 vulnerability.
- Review your VPN configurations to ensure they are not exposing your systems to this vulnerability.
- Monitor logs for specific indicators of compromise related to the iked process.
- Disable dynamic peer BOVPNs if your device is vulnerable and create an alias for static IP addresses.
- Stay informed about other vulnerabilities listed by CISA that may affect your systems.
Key Terms & Concepts
- CVE-2025-14733: In this article, CVE-2025-14733 refers to a critical vulnerability in WatchGuard’s Fireware OS that allows remote code execution.
- IKEv2: In this article, IKEv2 refers to a protocol used for establishing secure VPN connections.
- CVSS: In this article, CVSS stands for Common Vulnerability Scoring System, which rates the severity of vulnerabilities.
- IoCs: In this article, IoCs refers to indicators of compromise that help identify potential security breaches.
Read the original article here: https://thehackernews.com/2025/12/watchguard-warns-of-active-exploitation.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
