CVE-2025-14733

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 29.42%
EPSS Percentile: 98.19%
CISA KEV: YES — Known Exploited Vulnerability

Description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Published: 19-Dec-2025 08:16
Last Modified: 09-Sep-2026 11:17
EPSS Date: 2026-11-09
CWE: CWE-787

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:Red

CISA KEV Details

Date Added: 2025-12-19
Remediation Due: 2025-12-26
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14733

CNA Products / Version Status

WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

2025.1 ≤ version < 2025.1.4 — affected (custom)
12.0 ≤ version < 12.11.6 — affected (custom)
11.10.2 ≤ version ≤ 11.12.4+541730 — affected (custom)

Platforms: Default
WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

12.0 ≤ version < 12.3.1+728352 — affected (custom)

Platforms: FIPS
WatchGuard · Fireware OS Source: CNA · 5d1c2695-1a31-4499-88ae-e847036fd7e3
Default status: unaffected

12.0 ≤ version < 12.5.15 — affected (custom)

Platforms: T15/T35

Affected Products / Versions

watchguard / fireware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 11.10.2 · before (exclusive) 12.5.15
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
watchguard / fireware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 11.10.2 · before (exclusive) 12.11.6
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*
watchguard / fireware Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2025.1 · before (exclusive) 2025.1.4
cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*

References

Last enrichment sync: 09-Nov-2026 21:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution. Kaspersky’s Q3 2026 Threat Report Tracks Ransomware, macOS and IoT Activity
CISA has confirmed that ransomware gangs are exploiting CVE-2025-14733, a critical WatchGuard Firebox firewall flaw that allows unauthenticated remote code execution through an out-of-bounds write. CISA Says Ransomware Gangs Are Exploiting WatchGuard Firebox RCE Flaw

CVE (8)

Malware (7)

Threat Actors (7)

MITRE ATT&CK (2)

Vendors (7)

Products (7)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.