Threat Actors Exploit Zero-Day in WatchGuard Firebox Devices

A zero-day vulnerability in WatchGuard Firebox firewalls, tracked as CVE-2025-14733, is under active exploitation and can allow remote code execution on Firebox devices. The flaw is a critical out-of-bounds write in WatchGuard’s Fireware OS and affects Fireware OS versions including 11.10.2, 11.12.4_Update1, 12.0 or higher, and 2025.1 and higher; according to WatchGuard's advisory, it impacts both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

According to WatchGuard’s advisory, a patch was made available on 18 December, and WatchGuard observed threat actors actively exploiting the vulnerability in the wild, with four IP addresses listed as indicators of compromise.

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-14733 to its Known Exploited Vulnerabilities (KEV) catalog the day after WatchGuard disclosed the flaw, and Shadowserver Foundation noted nearly 125,000 IP addresses for vulnerable Firebox devices globally, with more than 35,000 in the United States. WatchGuard urged customers to upgrade Firebox appliances promptly and, in the interim, offered a temporary workaround for devices limited to Branch Office VPN tunnels to static gateway peers.