Successful exploitation of CVE-2025-14733 could allow a remote unauthenticated attacker to execute code remotely.
Successful exploitation of CVE-2025-14733 could allow a remote unauthenticated attacker to execute code remotely.
The following platforms are known to be affected:
Fireware OS versions:
Firebox appliances are vulnerable if using an affected Fireware OS version (see above) and have one of the following configurations:
Note: If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
CVE-2025-14733 Under Exploitation
WatchGuard has reported that CVE-2025-14733 in the Fireware OS used by Firebox is under exploitation. Successful exploitation can allow a remote unauthenticated attacker to execute arbitrary code on the Firebox appliance.
The NHS England National CSOC assesses further exploitation as likely.
WatchGuard has released security updates to address a critical vulnerability in the Fireware operating system used by Firebox devices.
Affected organisations are strongly encouraged to review WatchGuard security advisory WGSA-2025-00027 and apply the relevant updates as soon as possible.
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.
Last edited: 19 December 2025 1:25 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
