CVE-2025-14733 - WatchGuard Firebox iked Out of Bounds Write Vulnerability

Back Back to CVE browser

CRITICAL KEV

WatchGuard Firebox iked Out of Bounds Write Vulnerability

Published Dec 19, 2025 ·Due Dec 26, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 26.51%

Description

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.

If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Affected products

Vendor WatchGuard Product Fireware OS Default
unaffected
- Version
  11.10.2
  Status
  affected
  Constraints
  <=11.12.4+541730
- Version
  12.0
  Status
  affected
  Constraints
  <12.11.6
- Version
  12.0
  Status
  affected
  Constraints
  <12.3.1+728352
- Version
  12.0
  Status
  affected
  Constraints
  <12.5.15
- Version
  2025.1
  Status
  affected
  Constraints
  <2025.1.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WatchGuard

Fireware OS

unaffected

Version	Status	Constraints
11.10.2	affected	<=11.12.4+541730
12.0	affected	<12.11.6
12.0	affected	<12.3.1+728352
12.0	affected	<12.5.15
2025.1	affected	<2025.1.4

Remediation

Vendor solution

Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DNMzKAO&lang=en_US).

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204437
Advisory
https://psirt.watchguard.com/CVE-2025-14733
vendor-advisoryBroken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733
government-resourceUS Government Resource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204437		Advisory
https://psirt.watchguard.com/CVE-2025-14733		vendor-advisoryBroken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733		government-resourceUS Government Resource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027		vendor-advisoryVendor Advisory