WatchGuard Patches Firebox Zero-Day Exploited in the Wild

WatchGuard has released patches for a critical-severity vulnerability in the Firebox firewalls, warning that it has been exploited in the wild. Tracked as CVE-2025-14733 (CVSS score of 9.3), the zero-day is an out-of-bounds write issue in the Fireware OS’s iked process, and successful exploitation could allow remote, unauthenticated attackers to execute arbitrary code on vulnerable devices, according to the vendor’s advisory.

The Shadowserver Foundation has reported detecting roughly 125,000 IP addresses associated with WatchGuard firewalls affected by CVE-2025-14733, including nearly 40,000 in the United States. The vulnerability affects Fireware OS versions 11.x, 12.x, and 2025.x, and has been addressed in versions 2025.1.4, 12.11.6, 12.5.15, and 12.3.1_Update4 (B728352), with no patch for Fireware OS 11.x which has reached end-of-life.

On 22 December 2025, CISA added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog, urging federal agencies to remediate swiftly, per Binding Operational Directive 22-01.