Unauthenticated out-of-bounds write in WatchGuard Fireware iked gives remote code execution on Firebox (CVE-2025-14733)
CISA updated its catalog entry today to record ransomware use of this Firebox flaw, as reported by BleepingComputer on 2026-09-10, so an unpatched appliance with IKEv2 VPN exposed is a direct ransomware entry point.
An out-of-bounds write in the iked process of WatchGuard Fireware OS lets a remote, unauthenticated attacker run arbitrary code on the appliance. It affects mobile user VPN with IKEv2 and branch office VPN with IKEv2 to a dynamic gateway peer, and a device whose IKEv2 configurations were deleted can remain vulnerable if a branch office VPN to a static gateway peer is still configured. WatchGuard has observed post-exploitation theft of the device configuration and the local management user database.
Affected: WatchGuard Fireware OS >= 2025.1 < 2025.1.4; WatchGuard Fireware OS >= 12.0 < 12.11.6; WatchGuard Fireware OS >= 11.10.2 <= 11.12.4+541730; WatchGuard Fireware OS (T15/T35) >= 12.0 < 12.5.15; WatchGuard Fireware OS (FIPS) >= 12.0 < 12.3.1+728352
How to Test
Check the running Fireware OS version in Fireware Web UI / System Manager against the affected ranges above, and confirm whether any IKEv2 mobile user VPN or branch office VPN (including a static-peer BOVPN left behind after deleting IKEv2 configs) is configured. For compromise checks, set iked diagnostic logging to Info and look for IKE_AUTH request log lines with an abnormally large IDi payload (greater than 100 bytes), and for outbound transfers of the active configuration file or a gzip archive containing the configuration plus the local management user database to the same IP address the connection originated from; where exploitation is suspected, rotate all secrets stored on the Firebox.
How to Patch
Upgrade Fireware OS to 2025.1.4, 12.11.6, 12.5.15 (T15/T35) or 12.3.1+728352 (FIPS), or to any release above 11.12.4+541730 if still on the 11.x branch. If the upgrade cannot be scheduled immediately, remove or restrict internet-facing IKEv2 VPN configurations (including branch office VPNs to static gateway peers on devices that previously used IKEv2) and limit IKE reachability to known peer addresses.