Which versions of WatchGuard Fireware are affected by CVE-2025-14733?

WatchGuard Fireware OS contains a critical unauthenticated remote code execution vulnerability (CVSS 9.3) in the IKE daemon affecting all Firebox appliances configured for IKEv2 VPN, whether for…

Is CVE-2025-14733 being actively exploited?

Yes, CVE-2025-14733 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-14733?

Within 24 hours, inventory all Firebox appliances in your environment and identify those with active IKEv2 branch-office or mobile VPN configurations; simultaneously check firewall logs and IDS/IPS systems for exploitation attempts (look for unusual IKE protocol traffic or crashes in iked processes). Within 7 days, implement emergency network segmentation to restrict management access and IKE traffic to affected appliances to only trusted sources, deploy IDS/IPS signatures to detect malicious IKE payloads, and contact WatchGuard Security for a patch availability timeline. Within 30 days, prepare an alternative VPN architecture (hardware refresh, software-based solutions, or service provider migration) as a contingency; deploy the vendor patch immediately upon release if available.

WatchGuard Fireware CVE-2025-14733

Q: What is the CVSS score of CVE-2025-14733?

CVE-2025-14733 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 22.3%.

CRITICAL

Out-of-bounds Write (CWE-787)

2025-12-19 5d1c2695-1a31-4499-88ae-e847036fd7e3

Microsoft Memory Corruption RCE Buffer Overflow Watchguard Fireware

9.3

CVSS 4.0 · Vendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

Severity by source

Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

vuln.today AI

9.8 CRITICAL

Pre-authentication IKEv2 processing in a network-facing daemon gives AV:N/AC:L/PR:N/UI:N, and memory-corruption RCE yields full C:H/I:H/A:H on the appliance itself (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).

CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Aug 10, 2026 - 20:34 CISA

Analysis Generated

Aug 10, 2026 - 20:31 vuln.today

CVE Published

Dec 19, 2025 - 01:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

AnalysisAI

Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an unauthenticated remote attacker run arbitrary code on Firebox appliances that use IKEv2 for mobile user VPN or for a branch office VPN with a dynamic gateway peer. Notably, appliances remain exposed even after those configurations are removed if any IKEv2 branch office VPN to a static gateway peer is still configured, widening the vulnerable population beyond current dynamic-peer setups. The CISA KEV catalog reference indicates confirmed active exploitation, and the CVSS 4.0 base score of 9.3 reflects unauthenticated network-facing RCE.

Technical ContextAI

The flaw is a CWE-787 out-of-bounds write in the iked process, the Internet Key Exchange daemon responsible for negotiating IPsec/IKEv2 VPN tunnels on WatchGuard's Fireware operating system (cpe:2.3:o:watchguard:fireware). IKE negotiation happens before any user authentication completes, so a memory-safety defect in the daemon's parsing of IKEv2 protocol messages is reachable by any peer that can initiate a key exchange. An out-of-bounds write corrupts memory beyond an intended buffer, and in a network daemon written in a memory-unsafe language this is the classic primitive for hijacking control flow and achieving arbitrary code execution, consistent with the Memory Corruption / Buffer Overflow tags supplied. Because Fireware runs on network perimeter firewall appliances, the vulnerable service is typically exposed on the WAN/internet-facing interface handling VPN traffic.

RemediationAI

Apply the WatchGuard-provided Fireware update per the vendor PSIRT advisory (https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 and https://psirt.watchguard.com/CVE-2025-14733); the exact fixed Fireware version is not present in the supplied input and must be taken from that advisory rather than assumed. If immediate patching is not possible, the specific compensating control is to remove the vulnerable IKEv2 configurations - disable the mobile user VPN with IKEv2 and any branch office VPN using IKEv2 to a dynamic gateway peer - but note the important caveat from the description that deleting these does NOT clear exposure if an IKEv2 branch office VPN to a static gateway peer remains, so a fully mitigating posture may require removing all IKEv2 VPN configurations, which will break IKEv2 tunnels and remote access for legitimate users. Where operationally feasible, additionally restrict which source addresses can reach the IKE service (UDP 500/4500) on the internet-facing interface to known peer IPs, accepting that this does not protect against a spoofed or compromised authorized peer and is not viable for mobile/roaming users with dynamic addresses.