WatchGuard has issued an urgent warning about a critical zero-day vulnerability affecting its Firebox firewall appliances.
Threat actors are currently exploiting the flaw in active attacks against unpatched devices worldwide.
The Vulnerability Details
The vulnerability, identified as CVE-2025-14733, is an out-of-bounds write flaw in the iked process that handles IKEv2 VPN negotiations.
This critical flaw allows remote attackers to gain complete control of vulnerable firewalls without requiring any authentication credentials.
The vulnerability carries a severe CVSS score of 9.3, indicating critical severity. It explicitly impacts Firebox appliances configured for mobile user VPNs using IKEv2 or for branch office VPNs with dynamic gateway peers.
Attack Method and Impact
Attackers can exploit this vulnerability by sending a specially crafted request to an affected firewall. The malicious request triggers a memory-corruption error in the iked process, allowing the attacker to execute arbitrary code remotely.
Once successful, attackers gain arbitrary code execution, enabling them to install malware, execute malicious commands, and gain complete administrative control of the device.
WatchGuard has confirmed that threat actors are actively exploiting this vulnerability in the wild.
Security researchers warn that even if a vulnerable VPN configuration was previously deleted, devices may remain at risk if a static branch-office VPN is still configured.
System administrators should immediately examine their firewall logs for signs of compromise. Key indicators include the iKed process crashing or becoming unresponsive.
Additionally, administrators should monitor for log messages containing “Invalid peer certificate chain” or “Abnormally large IKE_AUTH request CERT payload” that exceed 2000 bytes.
Threat intelligence has linked known malicious activity to four specific IP addresses: 45.95.19.50, 51.15.17.89, 172.93.107.67, and 199.247.7.82.
WatchGuard has released critical software patches to address this vulnerability. Administrators must immediately upgrade their systems to one of the patched versions: Fireware OS 2025.1.4, 12.11.6, or 12.5.15.
The company strongly emphasizes that if a device was potentially compromised before patches were applied, administrators must rotate all locally stored secrets after updating the system.
Given the active exploitation of this vulnerability in the wild, WatchGuard urges all customers to prioritize patching immediately.
The zero-day nature of this flaw, combined with confirmed active attacks, makes rapid deployment of security updates essential to protect critical network infrastructure from compromise.
Organizations should treat this as a critical incident and allocate resources to patch affected firewalls without delay.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
%20(1).webp?fit=1600,900&ssl=1&description=WatchGuard has issued an urgent warning about a critical zero-day vulnerability affecting its Firebox firewall appliances.){kind=link}