CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability
WatchGuard · Firebox · NVD published 2025-12-19 · posted 2025-12-19 · last modified 2026-09-09
What it is
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
| Weakness | CWE-787 |
|---|---|
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red (source: 5d1c2695-1a31-4499-88ae-e847036fd7e3) |
| CISA due date | 2025-12-26 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | Initial Access → Execution |
Exploitation evidence
First exploit evidence seen: 2025-12-19 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2025-12-19. Source
Public exploit code
GitHub proof-of-concept repositories below quality bar
1 public repositories from 1 accounts, first seen 2025-12-23.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: CISA KEV · nomi-sec/PoC-in-GitHub.
Defend the Chain
The attack chain for CVE-2025-14733 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1190 Exploit Public-Facing Application Inferred
Inferred from description keywords
How to fix it
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)
Fixed versions
- watchguard fireware: upgrade to 12.5.15 or later (affected from 11.10.2)
- watchguard fireware: upgrade to 12.11.6 or later (affected from 11.10.2)
- watchguard fireware: upgrade to 2025.1.4 or later (affected from 2025.1)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 (CISA KEV notes)
MITRE ATT&CK mitigations for this chain
- M1048 Application Isolation and Sandboxing (for T1190, T1203) : Application isolation will limit what other processes and system features the exploited target can access.
- M1037 Filter Network Traffic (for T1190) : Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reduci
- M1030 Network Segmentation (for T1190) : Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
- M1016 Vulnerability Scanning (for T1190) : Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
- M1026 Privileged Account Management (for T1190) : Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
- M1050 Exploit Protection (for T1190, T1203) : Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
- M1035 Limit Access to Resource Over Network (for T1190) : Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
- M1051 Update Software (for T1190, T1203) : Update software regularly by employing patch management for externally exposed applications.
Detection Generic guidance
- Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.
- Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.