WatchGuard Fireware
CVE-2025-14733
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing IKE service
-
DeliverySend crafted IKEv2 packets
-
ExploitTrigger out-of-bounds write in iked
-
ExecutionCorrupt memory to hijack control flow
-
ImpactExecute arbitrary code on Firebox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Firebox to have an IKEv2 VPN configuration reachable by the attacker: specifically the mobile user VPN with IKEv2, or a branch office VPN using IKEv2 to a dynamic gateway peer. Critically, a Firebox also remains vulnerable if those configurations were previously present and later deleted while an IKEv2 branch office VPN to a static gateway peer is still configured - so removing the obvious dynamic/mobile configs is NOT sufficient by itself. No authentication is needed (CVSS PR:N) and no user interaction is required (UI:N); the limiting factor is purely whether one of these IKEv2 configurations exists and the IKE service is reachable on the network. Fireboxes with no IKEv2 VPN configuration of any kind are not affected. |
| Impact | All signals point to genuine, high-priority risk rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes unauthenticated, low-complexity, network-reachable exploitation with full confidentiality, integrity, and availability impact on the affected system, and no attack requirements or user interaction. The presence of a CISA KEV catalog reference for this CVE indicates confirmed active exploitation, which outweighs the absence of an EPSS score in the input. EPSS and explicit POC availability were not provided, so exploitation-probability modeling and public exploit-code status are unknown from this data; however, KEV status makes EPSS largely moot for prioritization. One nuance defenders must weigh: the vulnerable condition is configuration-dependent (IKEv2 mobile user VPN or dynamic-peer BOVPN, or residual static-peer BOVPN after those were deleted), so exposure is not universal across all Fireboxes despite the network vector. |
| Exploit ScenarioDerived | An attacker who can reach the Firebox's internet-facing IKE service sends crafted IKEv2 negotiation packets to the iked daemon, triggering the out-of-bounds write during key-exchange message processing before any authentication is required. By shaping the memory corruption, the attacker achieves arbitrary code execution on the firewall appliance, gaining a foothold at the network perimeter. Given the CISA KEV listing, exploitation is occurring in practice; explicit public POC status is not confirmed in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 10, 2026
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an unauthenticated remote attacker run arbitrary code on Firebox appliances that use IKEv2 for mobile user VPN or for a branch office VPN with a dynamic gateway peer. Notably, appliances remain exposed even after those configurations are removed if any IKEv2 branch office VPN to a static gateway peer is still configured, widening the vulnerable population beyond current dynamic-peer setups. The CISA KEV catalog reference indicates confirmed active exploitation, and the CVSS 4.0 base score of 9.3 reflects unauthenticated network-facing RCE.
RemediationAI
Apply the WatchGuard-provided Fireware update per the vendor PSIRT advisory (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 and https://psirt.watchguard.com/CVE-2025-14733); the exact fixed Fireware version is not present in the supplied input and must be taken from that advisory rather than assumed. If immediate patching is not possible, the specific compensating control is to remove the vulnerable IKEv2 configurations - disable the mobile user VPN with IKEv2 and any branch office VPN using IKEv2 to a dynamic gateway peer - but note the important caveat from the description that deleting these does NOT clear exposure if an IKEv2 branch office VPN to a static gateway peer remains, so a fully mitigating posture may require removing all IKEv2 VPN configurations, which will break IKEv2 tunnels and remote access for legitimate users. Where operationally feasible, additionally restrict which source addresses can reach the IKE service (UDP 500/4500) on the internet-facing interface to known peer IPs, accepting that this does not protect against a spoofed or compromised authorized peer and is not viable for mobile/roaming users with dynamic addresses.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-787 out-of-bounds write in the iked process, the Internet Key Exchange daemon responsible for negotiating IPsec/IKEv2 VPN tunnels on WatchGuard's Fireware operating system (cpe:2.3:o:watchguard:fireware). IKE negotiation happens before any user authentication completes, so a memory-safety defect in the daemon's parsing of IKEv2 protocol messages is reachable by any peer that can initiate a key exchange. An out-of-bounds write corrupts memory beyond an intended buffer, and in a network daemon written in a memory-unsafe language this is the classic primitive for hijacking control flow and achieving arbitrary code execution, consistent with the Memory Corruption / Buffer Overflow tags supplied. Because Fireware runs on network perimeter firewall appliances, the vulnerable service is typically exposed on the WAN/internet-facing interface handling VPN traffic.
Know when Watchguard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
Pre-authentication IKEv2 processing in a network-facing daemon gives AV:N/AC:L/PR:N/UI:N, and memory-corruption RCE yields full C:H/I:H/A:H on the appliance itself (S:U).
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
2DescriptionCVE.org
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Executive ViewAI
WatchGuard Fireware OS contains a critical unauthenticated remote code execution vulnerability (CVSS 9.3) in the IKE daemon affecting all Firebox appliances configured for IKEv2 VPN, whether for mobile access or branch connectivity. The vulnerability is confirmed actively exploited (CISA KEV) with no vendor-released patch identified at time of analysis, leaving affected VPN gateways open to complete compromise. Organizations relying on these appliances for secure remote access face immediate risk of infrastructure takeover.
Network segmentation: restrict IKE (UDP 500/4500) and management access to affected Firebox appliances to whitelisted, trusted source IPs only. Enhanced monitoring: deploy IDS/IPS signatures to detect malicious IKE packets and unusual iked process behavior. Temporary architectural workarounds: disable IKEv2 configurations on non-critical appliances if business operations permit; for critical VPN paths, consider temporary failover to alternative VPN protocols or third-party VPN gateways while awaiting patch. Increase log retention and alerting on Firebox appliances for anomalous process termination and high-volume failed connection attempts.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated high severity
GitHub PoC
Exploit-DB