CVE-2025-14733: WatchGuard Firebox iked IKEv2 RCE (KEV, Known Ransomware Use)

CVE-2025-14733 is an out-of-bounds write in the iked process of WatchGuard Fireware OS that lets a remote, unauthenticated attacker execute arbitrary code on a Firebox appliance via IKEv2 VPN, and CISA's KEV catalog records this one as having known ransomware campaign use — one of the stronger severity signals in this round.

CVE-2025-14733 (CWE-787, Out-of-bounds Write) affects the iked process in WatchGuard Fireware OS. NVD's description states it "may allow a remote unauthenticated attacker to execute arbitrary code" and "affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer." Notably, NVD's description adds a persistence caveat: "If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured" (NVD).

NVD's own analysis gives it a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact. WatchGuard's own CNA submission separately scores it CVSS v4.0 9.3 (critical) and explicitly sets the Provider Urgency extension to "Red," its highest urgency flag (NVD).

WatchGuard's own PSIRT advisory (WGSA-2025-00027) lists the precise affected and fixed ranges: Fireware OS 2025.1 up to but not including 2025.1.4, and 12.0 up to but not including 12.11.6 for most Firebox models; the T15/T35 branch is vulnerable from 12.0 up to but not including 12.5.15; the FIPS branch from 12.0 up to but not including 12.3.1+728352; and legacy 11.10.2 through 11.12.4+541730. The advisory was first published 2025-12-19 and last updated 2026-08-10 (WatchGuard PSIRT Advisory WGSA-2025-00027).

CISA added CVE-2025-14733 to the Known Exploited Vulnerabilities (KEV) catalog the same day it was published, 2025-12-19 (catalog version 2026.10.29, 1764 entries, confirmed live this run), with an unusually tight required-action due date of 2025-12-26, and — distinct from most entries in this batch — records knownRansomwareCampaignUse as "Known", and instructs organizations to "check for signs of potential compromise on all internet accessible instances after applying mitigations" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.29423 (98.176th percentile) — among the higher EPSS scores in this batch, consistent with the confirmed ransomware use and the appliance's typical placement at the network edge terminating VPN traffic (FIRST EPSS).

Any Firebox appliance on an affected Fireware OS build with IKEv2 mobile-user VPN or dynamic-gateway-peer branch-office VPN configured — even if that configuration was later deleted, per WatchGuard's own caveat — should be patched to the fixed builds above immediately and checked for signs of prior compromise given the documented ransomware use.

• Out-of-bounds write in the iked process of WatchGuard Fireware OS lets a remote unauthenticated attacker execute arbitrary code via IKEv2 VPN (mobile-user or branch-office with dynamic gateway peer); a Firebox can remain vulnerable after such configs are deleted if a static-gateway-peer branch-office VPN is still configured. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); WatchGuard's own CVSS v4.0 submission scores it 9.3 and sets Provider Urgency to Red. — NVD
• Affected: Fireware OS 2025.1-2025.1.3 (fixed 2025.1.4) and 12.0-12.11.5 (fixed 12.11.6); T15/T35 12.0-12.5.14 (fixed 12.5.15); FIPS 12.0-12.3.1+728351 (fixed 12.3.1+728352); legacy 11.10.2-11.12.4+541730. Advisory published 2025-12-19, updated 2026-08-10. — WatchGuard PSIRT Advisory WGSA-2025-00027
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-12-19, required-action due date 2025-12-26, knownRansomwareCampaignUse recorded as "Known"; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.29423 (98.176th percentile) as of 2026-10-29. — FIRST EPSS