The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware gangs are now using CVE-2025-14733, a critical vulnerability in WatchGuard Firebox firewalls, in active attacks. The flaw stems from an out-of-bounds write in the firewall’s IKEv2 VPN handling, allowing unauthenticated attackers to execute arbitrary code remotely in low-complexity attacks — no credentials, no user interaction required.
WatchGuard patched the flaw in December 2025 and at the time confirmed it was already being exploited. Internet security watchdog Shadowserver found over 115,000 unpatched Firebox devices exposed online at the time of the original disclosure. Nine months later, nearly 9,000 devices remain vulnerable and internet-accessible. CISA originally ordered U.S. federal agencies to patch within a week under Binding Operational Directive 22-01; Thursday’s update extends that urgency by naming ransomware as the active threat category. WatchGuard published indicators of compromise (IoCs) in December that administrators can use to determine whether their device has already been compromised.
How to check if you’re affected
Affected versions of Fireware OS include 11.x (including 11.12.4_Update1), 12.x (including 12.11.5), and 2025.1 through 2025.1.3. Your Firebox is vulnerable only if it is configured to use IKEv2 VPN — however, WatchGuard has warned that devices may still be at risk even after disabling that configuration if a branch office VPN to a static gateway peer remains active. Log into your Firebox management console and verify you are running a patched firmware version. If unsure, cross-reference the IoCs published by WatchGuard in December 2025.
Sources
- BleepingComputer: CISA — WatchGuard RCE flaw now exploited in ransomware attacks
- CISA Known Exploited Vulnerabilities Catalog (cisa.gov/known-exploited-vulnerabilities-catalog)