WatchGuard Fixes Firewall Zero-Day Being Actively Exploited

Attackers are actively attempting to exploit a zero-day vulnerability in WatchGuard Firebox firewalls to remotely execute code. A patch is available to fix the flaw.

See Also: OnDemand Webinar | Trends, Threats and Expert Takeaways: 2025 Global IR Report Insights

“WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild,” says the vendor’s security alert, published Thursday and updated Friday.

The critical flaw, which rates a CVSS score of 9.3, is tracked as CVE-2025-14733.

Scans of the internet conducted by The Shadowserver Foundation on Saturday cataloged nearly 125,000 unpatched devices, of which the greatest number, 38,300, traced to IP addresses in the United States, followed by 14,000 in Germany and 12,300 in Italy. By Sunday, the total count of vulnerable devices dropped by 6%, to 117,490.

Seattle-based WatchGuard says its devices are used by more than 250,000 small and midsize enterprises, school and government agencies globally to protect their digital assets, including over 10 million endpoints.

The risk posed by the vulnerability is serious, in part because of what these devices often get entrusted to protect. “WatchGuard appliances running Fireware OS aren’t just firewalls; they’re VPN concentrators, policy enforcement engines, intrusion prevention systems and in many cases, the first and last line of defense for an entire organization,” said threat intelligence firm watchTowr.

These types of edge devices also remain a top, repeat target for hackers of all stripes, from nation-state cyberespionage teams to cybercrime syndicates, including ransomware operations (see: Verizon Reports Surge in Breaches Tied to Edge Devices).

WatchGuard on Thursday released Fireware OS versions 2025.1.4, 12.11.6, 12.5.15 and 12.3.1_Update4 (B728352) to patch the flaw. While Fireware OS version 11.x also has the vulnerability, the vendor said it’s no longer being supported and won’t get an update.

The U.S. Cybersecurity and Infrastructure Security Agency on Friday added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog, setting a due date of this Friday for federal civilian agencies to either apply patches and mitigations for the flaw or discontinue using vulnerable products.

Any organization that finds suspicious activity must do more than just patch to fully mitigate the flaw and ensure attackers aren’t still enjoying full, remote access to the device.

“In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances,” WatchGuard said, noting that it has issued detailed instructions for how to do so.

CVE-2025-14733 is an out-of-bounds write vulnerability in the WatchGuard Fireware OS iked – for internet key exchange daemon – process, which performs mutual authentication and establishes and maintains IPSec flows and security associations. An out-of-bounds write vulnerability exists when an attacker can write data before the beginning or past the end of an intended buffer in memory, which can facilitate remote code execution, corruption of data or a system crash.

“This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer,” WatchGuard said.

“If the Firebox was previously configured with the mobile user VPN with IKEv2 or a Branch Office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured,” it said.

The vendor has published a handful of IP addresses as “indicators of attack.” Any inbound connections from them might reflect reconnaissance or exploitation attempts, while any outbound connections should be considered “a strong indicator of compromise.”

Another strong indicator is if the IKED process, which handles IKE negotiations, suddenly hangs, “interrupting VPN tunnel negotiations and re-keys,” it said.