WatchGuard Warns of Active Exploitation of Critical Fireware OS VPN Vulnerability

WatchGuard has released fixes for a critical Fireware OS vulnerability that has been observed in real-world attacks, tracked as CVE-2025-14733 (CVSS 9.3). According to WatchGuard, the out-of-bounds write affects the iked process and could allow a remote unauthenticated attacker to execute arbitrary code, impacting both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

The company notes that if Firebox devices were previously configured with those VPNs and those configurations have since been deleted, they may still be vulnerable if a branch office VPN to a static gateway peer remains configured. The vulnerability affects several Fireware OS versions, with fixes in 2025.1.4 for 2025.1, 12.11.6 for 12.x, 12.5.15 for 12.5.x (T15 & T35 models), and 12.3.1_Update4 for 12.3.1 (FIPS).

WatchGuard has observed threat actors actively attempting exploitation in the wild, with IoCs and several IPs provided to help device owners detect infection, and notes that this comes a little over a month after CISA added another WatchGuard Fireware OS flaw to its KEV catalog.