CVE-2025-14733: WatchGuard Firebox Out of Bounds Write Vulnerability
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
Other sources
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WatchGuard Fireware OS (iked process)to a version that resolves this vulnerability.Fixed in 2025.1.4 - Upgrade
Upgrade
WatchGuard Fireware OS (iked process)to a version that resolves this vulnerability.Fixed in 12.11.6 - Upgrade
Upgrade
WatchGuard Fireware OS (iked process)to a version that resolves this vulnerability.Fixed in 12.5.15 - Upgrade
Upgrade
WatchGuard Fireware OS (iked process)to a version that resolves this vulnerability.Fixed in 12.3.1-b728352 - Compensating control
For affected Firebox configurations, ensure that the mobile user VPN with IKEv2 and branch office VPN using IKEv2 to a dynamic gateway peer are not used; additionally verify that if those IKEv2 configurations were deleted, the Firebox may still be vulnerable if a branch office VPN to a static gateway peer remains configured.
- Operational
If administrators have confirmed threat actor activity on their Firebox appliances, rotate all locally stored secrets on vulnerable Firebox appliances using the procedures in WatchGuard’s “Best Practices to Rotate Shared Secrets Stored on the Firebox” knowledge base article.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14733?
The severity of CVE-2025-14733 is high, as it allows remote unauthenticated attackers to execute arbitrary code.
How do I fix CVE-2025-14733?
To fix CVE-2025-14733, update your WatchGuard Fireware OS to the latest version that addresses this vulnerability.
What systems are affected by CVE-2025-14733?
CVE-2025-14733 affects WatchGuard Fireware OS versions between 11.10.2 and 11.12.4_Update1, 12.0 and 12.11.5, and 2025.1 and 2025.1.3.
Can CVE-2025-14733 be exploited remotely?
Yes, CVE-2025-14733 can be exploited remotely without authentication, making it critical to address immediately.
What impact does CVE-2025-14733 have on network security?
CVE-2025-14733 poses a significant risk to network security by allowing unauthorized code execution on affected devices.