CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA confirms ransomware gangs are exploiting critical unauthenticated RCE CVE-2025-14733 in WatchGuard Firebox firewalls, with roughly 9,000 devices still unpatched.
CVE-2025-14733 is an out-of-bounds write in WatchGuard Fireware OS allowing unauthenticated remote code execution, exploitable on firewalls configured for IKEv2 VPN and potentially even after the configuration was deleted if a static branch-office VPN peer remains. WatchGuard released patches in December and confirmed in-the-wild exploitation; Shadowserver found over 115,000 exposed Fireboxes at the time, with nearly 9,000 still unpatched after nine months. CISA added the flaw to its Known Exploited Vulnerabilities catalog in December under BOD 22-01 and on Thursday confirmed ransomware gangs are now exploiting it, without providing campaign details. WatchGuard serves more than 250,000 small and mid-sized companies through 17,000+ security resellers and service providers.
- CVE-2025-14733 is an out-of-bounds write enabling unauthenticated remote code execution on IKEv2 VPN-configured Fireboxes.
- CISA added the flaw to its KEV catalog in December, ordering federal patching within a week.
- Shadowserver found over 115,000 exposed Fireboxes in December; nearly 9,000 remain unpatched after nine months.
- WatchGuard serves over 250,000 SMBs through 17,000+ resellers and published IOCs to check compromise.
- Vendors
- WatchGuard
- Products
- FireboxFireware OS
- Organizations
- CISAShadowserver
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-23176 | Privilege Escalation in WatchGuard Firebox/XTM Fireware OS | 8.8 | 11% | KEV | KEV |
| CVE-2025-14733 | Unauthenticated Out-of-Bounds Write RCE in WatchGuard Fireware OS | 9.3 | 29% | KEVRansomware | KEV |
| CVE-2025-9242 | Out-of-Bounds Write in WatchGuard Fireware OS iked Enables Unauthenticated RCE | 9.3 | 92% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.