Live › vulnerability › CVE-2025-14733
Go to dashboardWatchGuard Fireware OS has an out-of-bounds write in its iked process that affects IKEv2 mobile user VPN and branch office VPN with a dynamic gateway peer. A remote unauthenticated attacker may be able to run arbitrary code on the Firebox appliance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WatchGuard Firebox | vendor | – | – |
| watchguard fireware | vendor | >= 11.10.2, < 12.5.15 | 12.5.15 |
| watchguard fireware | vendor | >= 11.10.2, < 12.11.6 | 12.11.6 |
| watchguard fireware | vendor | >= 2025.1, < 2025.1.4 | 2025.1.4 |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
This page as .md · .json · in your agent: get_signal("CVE-2025-14733")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.