WatchGuard Firebox CVE-2025-14733: Ransomware Gangs Actively Exploiting 9,000 Unpatched Devices

CVE-2025-14733 is a CWE-787 (out-of-bounds write) vulnerability in the IKEv2 implementation within Fireware OS on WatchGuard Firebox appliances. IKEv2 is the protocol used to negotiate IPsec security associations for VPN tunnels, operating on UDP port 500 for initial exchanges and UDP port 4500 when NAT traversal is in use. The Firebox processes IKEv2 exchanges as part of its mobile VPN functionality, which is enabled by default on many configurations.

The vulnerability is triggered during the initial IKEv2_SA_INIT exchange, the first step in a VPN negotiation. The Firebox receives an IKEv2 packet containing one or more payload attributes with malformed length values. The IKEv2 processing engine allocates a heap buffer based on the stated payload length, then copies data beyond that length into adjacent memory. The attacker controls the content of the overwritten region, enabling a write-what-where primitive that is sufficient to overwrite a function pointer and redirect execution into a shellcode payload embedded in the packet. Because the vulnerable code path executes before any credential or certificate validation occurs, the entire exploit succeeds without authentication.

The companion vulnerability CVE-2025-9242 used a structurally similar attack path in the same IKEv2 stack and was patched in September 2025. Organizations that applied that patch but skipped the December 2025 update for CVE-2025-14733 remain vulnerable. WatchGuard's December 2025 fix validates payload length fields against the actual remaining packet length before any heap allocation, blocking the overflow at its source.

For organizations that cannot patch immediately, disabling IKEv2 VPN in the Firebox configuration removes the attack surface entirely. Confirm the listener is inactive by verifying no process binds to UDP 500 or 4500 after the configuration change. Block those ports at the upstream router as a defense-in-depth control.

CISA's September 10, 2026 KEV addition confirms that an unnamed ransomware operator is actively exploiting CVE-2025-14733 in the wild. The campaign targets Firebox appliances that remain on Fireware OS versions released before December 2025, a population that shrunk from 115,000 at the time of the original advisory to approximately 9,000 today.

The 9,000 remaining unpatched devices are not randomly distributed. WatchGuard Firebox appliances are prevalent in SMB and mid-market environments where dedicated security operations teams are less common and firmware update cycles are longer. Ransomware groups with access to a validated exploit for this vulnerability face a concentrated set of targets where they can expect post-exploitation success at scale: organizations with valuable data, less mature incident response capability, and a high likelihood of paying to recover operations.

IKEv2-based ransomware entry is particularly effective because the exploit lands code execution on the network perimeter appliance itself, not on a workstation or server behind it. From the Firebox, the attacker has a trusted vantage point inside the network perimeter with full visibility into internal traffic, stored VPN credentials, and routing tables. The path from initial Firebox compromise to ransomware deployment on internal servers typically requires no additional public exploits and leaves fewer endpoint detection artifacts than an approach that traverses the perimeter through stolen credentials.

WatchGuard has published indicators of compromise and forensic guidance in the advisory at psirt.watchguard.com/CVE-2025-14733/. Organizations in finance, healthcare, and manufacturing, sectors historically targeted by the ransomware operators associated with perimeter appliance exploitation, should treat this as an active threat requiring immediate action rather than a scheduled patch cycle item.

See also: the FortiGate CVE-2025-25249 PivotC2 campaign from September 11 for a parallel ransomware-linked perimeter appliance exploitation pattern.

A successful CVE-2025-14733 exploit gives the attacker code execution on the Firebox appliance itself, running as the same privileged process that manages VPN sessions. From this position, ransomware operators follow a consistent playbook against perimeter appliances.

First, the attacker extracts stored credentials from the Firebox. Fireware OS stores VPN pre-shared keys, administrator account hashes, and Active Directory integration credentials on the appliance. Harvesting these credentials gives the attacker legitimate accounts they can use to authenticate to internal systems without triggering any alerts associated with brute-force activity.

Second, the attacker uses the Firebox as a pivot point. Traffic routing from the Firebox management interface appears trusted to internal network monitoring tools. The attacker can establish tunnels through the compromised appliance into the internal network, reaching domain controllers, file servers, and backup systems. In environments where the Firebox performs SSL inspection, the attacker may also intercept decrypted traffic flowing through the appliance.

Third, the attacker conducts internal reconnaissance. The Firebox has network-level visibility into all subnets it routes, making it effective for scanning internal IP ranges and identifying high-value targets such as domain controllers, Exchange servers, and NAS storage.

Fourth, the attacker deploys ransomware. With valid credentials, internal network access, and a full map of internal targets, the path to ransomware deployment requires no additional exploitation. The attacker can use legitimate administrative tools such as PsExec, WinRM, or Group Policy to deploy the ransomware payload across the internal network from behind the firewall perimeter.

Rotate all credentials stored in or accessible through the Firebox before treating a compromised device as clean, including VPN pre-shared keys, administrator passwords, and any Active Directory service accounts configured for Firebox authentication.

CVE-2025-14733 has been patchable since December 2025. The 9,000 devices still running vulnerable firmware nine months later reflect a well-documented pattern in SMB and mid-market firewall maintenance.

Network appliances require scheduled maintenance windows for firmware updates. Unlike server operating system patches that can often be applied with brief service interruptions, firewall firmware updates take the primary perimeter security control offline. Organizations with limited IT staff or no dedicated security team often defer appliance firmware updates until they can arrange coverage, which can mean months of delay.

WatchGuard Firebox appliances are common in managed service provider environments where the MSP is responsible for firmware maintenance across a large client portfolio. A single unpatched firmware template applied to many clients can result in widespread exposure when a critical vulnerability is confirmed exploited.

The companion vulnerability CVE-2025-9242, patched in September 2025, provides context for the patch adoption rate. At the time CVE-2025-14733 was disclosed in December 2025, organizations that had already patched for CVE-2025-9242 would have been protected. The remaining 115,000 unpatched devices at December 2025 disclosure represent organizations that had not applied either the September or December 2025 updates, indicating a pattern of extended firmware lag rather than a targeted decision not to patch.

MSPs and IT administrators managing WatchGuard Firebox estates should audit firmware versions across all managed appliances and prioritize any device running Fireware OS below the December 2025 patched release.

See also: our coverage of the N-able N-central CVE-2026-86218 MSP supply chain risk for the broader pattern of MSP-managed infrastructure vulnerability.

The following rules detect anomalous IKEv2 traffic patterns consistent with CVE-2025-14733 exploitation attempts and post-compromise outbound behavior from a compromised Firebox. Deploy in log-and-alert mode first and validate against your baseline IKEv2 VPN traffic before setting to block. Both rules carry experimental status.

Rule 1: Anomalous IKEv2 Negotiation from External Sources Detects inbound IKEv2 ISAKMP packets from non-VPN-peer external IP addresses with oversized or malformed payloads. Requires Zeek network logs or equivalent IKEv2 session logging.

Rule 2: Unexpected Outbound Connection from Firebox Management IP Detects outbound connections from the Firebox management interface IP to external destinations not associated with WatchGuard cloud services. Requires NetFlow or syslog from the Firebox.

Apply the patch or the interim disablement control now. WatchGuard has confirmed no workaround eliminates the vulnerability other than the December 2025 firmware update or disabling IKEv2.