CVE-2025-14733: WatchGuard Fireware iked out-of-bounds write allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote unauthenticated code execution on an internet-facing VPN gateway that is in CISA KEV with known ransomware use and a near-term remediation deadline.

What it is

WatchGuard Fireware OS contains an out-of-bounds write in the iked process reachable over the network. It affects IKEv2 mobile user VPN and branch office VPN configurations using a dynamic gateway peer, and Fireboxes may remain exposed even after those configurations are deleted if a static-gateway branch office VPN is still configured. Because it is remotely reachable without authentication, it is a serious edge-device flaw.

Impact

A remote unauthenticated attacker can execute arbitrary code on the Firebox, giving full control of the VPN gateway and a foothold at the network perimeter.

Attack surface

Reached over the network through the IKEv2 service on the Firebox; the CVSS vector shows no privileges or user interaction required. Any Firebox running an affected Fireware OS with the described IKEv2 configurations is exposed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-12-19 with a 2025-12-26 remediation due date and flags known ransomware campaign use, indicating active exploitation. EPSS gives a 30-day exploitation probability of about 26.5 percent (97.9th percentile).

What to do

• Apply the WatchGuard Fireware OS update referenced in advisory WGSA-2025-00027 as soon as possible.
• If patching is not immediately possible, disable IKEv2 mobile user VPN and IKEv2 branch office VPN configurations, including any static-gateway branch office VPN on devices that previously used the affected configurations.
• Restrict IKEv2 access to known peer addresses where operationally feasible.
• Follow CISA BOD 22-01 guidance and treat the 2025-12-26 due date as the remediation deadline.
• Review Firebox configurations for the affected IKEv2 setups and confirm removal or patching on every device.

Detection

• Monitor Firebox and perimeter logs for unexpected iked process crashes or restarts.
• Alert on anomalous IKEv2 traffic to the Firebox from untrusted or unexpected source addresses.
• Hunt for signs of post-exploitation activity on the Firebox, such as unexpected configuration changes, new accounts or outbound connections.
• Correlate Firebox logs with downstream network telemetry for lateral movement or ransomware staging from the VPN gateway.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.