WatchGuard Firebox appliances running Fireware OS are the subject of multiple government and vendor advisories after disclosure of a critical vulnerability tracked as CVE-2025-14733. The Canadian Centre for Cyber Security describes the issue as an out-of-bounds write in the iked IKE daemon affecting IKEv2 VPN configurations.
The Cyber Centre says successful exploitation can allow remote, unauthenticated code execution under specific VPN conditions. The affected scenarios include Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 where a dynamic gateway peer is enabled or was previously enabled. The advisory notes the exposure can persist even if the dynamic peer setting was enabled in the past.
Concern has increased due to signs of exploitation. The Cyber Centre cites open-source reporting that active exploitation is occurring, and the U.S. government has listed CVE-2025-14733 as a Known Exploited Vulnerability. Inclusion in the KEV catalog typically indicates activity beyond theoretical risk.
Fixed versions published by the Cyber Centre include Fireware OS 2025.1.4 for the 2025.1 release train, 12.11.6 for 12.x, 12.5.15 for T15 and T35 models, and 12.3.1_Update4 (build B728352) for FIPS-certified systems. Fireware OS 11.x is listed as end of life and does not receive a patch.
Mitigation guidance prioritizes urgent patching and review of logs and traffic for indicators of compromise cited in WatchGuard advisories. When immediate patching is not possible, the Cyber Centre points to configuration-based mitigations such as disabling dynamic peer Branch Office VPN configurations and reducing VPN exposure.
The vulnerability has drawn attention because it combines unauthenticated exploitation potential with exposure at perimeter VPN infrastructure, a frequent target in intrusion campaigns.
Sources: Canadian Centre for Cyber Security, WatchGuard, NIST NVD
—
By the Mobile ID World Editorial Team
