DaystoPatch

WatchGuardExploited incident

WatchGuard Firebox iked IKEv2 out-of-bounds write (unauthenticated RCE), exploited at disclosure

CVE-2025-14733Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 19 Dec 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    WatchGuard PSIRT WGSA-2025-00027 (Wayback snapshot 2025-12-19 11:45 UTC)CuratedQuote verified

    WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.

    Date is the advisory's own 'Published Date 2025-12-18' (no time or zone given; R5: the CVE record's 2025-12-19T00:01Z is not borrowed).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:522cf4c7bd18c515…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2025-14733)ClaimedQuote verified19 Dec 2025

    WatchGuard Firebox Out of Bounds Write Vulnerability

    Added to CISA's KEV catalog on 2025-12-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2025-14733 (CNA: WatchGuard)CuratedQuote verified19 Dec 2025, 00:01 UTC

    "assignerShortName":"WatchGuard","dateReserved":"2025-12-15T17:47:40.301Z","datePublished":"2025-12-19T00:01:55.722Z"

    WatchGuard's disclosure (which already said exploitation was being attempted) is the earliest public signal found. Discovered internally.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7af983aa1034dccc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-14733ClaimedQuote verified19 Dec 2025, 00:01 UTC

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7af983aa1034dccc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet19 Dec 2025, 01:03 UTC

    You can now share your thoughts on vulnerability CVE-2025-14733 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Dec 2025, 21:30 UTC

    📢 Alerte: vulnérabilité critique RCE dans WatchGuard Fireware OS (CVE-2025-14733) exploitée 📝 Le Centre canadien pour la cybersécurité (Alerte AL25-020,... 📖 cyberveille : https:// cyberveille.ch/posts/2025-12-2 6-alerte-vulnerabilite-criti

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    WatchGuard PSIRT WGSA-2025-00027 (Wayback snapshot 2025-12-19 11:45 UTC)CuratedQuote verified

    Published Date 2025-12-18

    The advisory's own date (no zone; likely US Pacific). The CVE record (2025-12-19T00:01Z = 2025-12-18 16:01 PST) is kept as a separate candidate.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:522cf4c7bd18c515…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    CVE record CVE-2025-14733 (CNA: WatchGuard)CuratedQuote verified19 Dec 2025, 00:01 UTC

    "datePublished":"2025-12-19T00:01:55.722Z"

    CVE record time. The advisory itself says 'Published Date 2025-12-18' (recorded separately at day precision).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7af983aa1034dccc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date onlysame day

    WatchGuard PSIRT WGSA-2025-00027 (Wayback snapshot 2025-12-19 11:45 UTC)CuratedQuote verified

    you can follow WatchGuard’s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 as a temporary workaround.

    Workaround section present in the first-day snapshot (applies only to Fireboxes with branch office VPNs to static peers). The same page's header says 'Workaround Available False'. Date is the advisory's own 'Published Date 2025-12-18' (no time or zone given; R5: the CVE record's 2025-12-19T00:01Z is not borrowed).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:522cf4c7bd18c515…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    WatchGuard PSIRT WGSA-2025-00027 (Wayback snapshot 2025-12-19 11:45 UTC)CuratedQuote verified

    In addition to installing the latest Fireware OS that contains the fix

    Resolved versions 2025.1.4, 12.11.6, 12.5.15 (T15/T35) and 12.3.1_Update4 (B728352, FIPS) were listed at publication with status 'Resolved'. Date is the advisory's own 'Published Date 2025-12-18' (no time or zone given; R5: the CVE record's 2025-12-19T00:01Z is not borrowed).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:522cf4c7bd18c515…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    WatchGuard PSIRT WGSA-2025-00027 (Wayback snapshot 2025-12-19 11:45 UTC)CuratedQuote verified

    In addition to installing the latest Fireware OS that contains the fix

    All supported branches had resolved versions at publication (2025.1.4, 12.11.6, 12.5.15, 12.3.1_Update4 in the first-day snapshot); Fireware 11.x is end of life and not counted. Date is the advisory's own 'Published Date 2025-12-18' (R5).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:522cf4c7bd18c515…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

WatchGuard Firebox VPN flaw exploited at disclosure; fixes out since Dec 18

Attackers were trying to exploit a critical flaw in the Firebox IKEv2 VPN service when WatchGuard released fixes on 18 December 2025 (US time).

In plain words

WatchGuard's Firebox firewalls had a critical flaw in their VPN service that attackers were already trying to use to take over devices and steal configurations. WatchGuard released fixed software on 18 December 2025 (US time). If we use Firebox VPNs, we need to be on the fixed versions, and if we see signs of attack we must change every password and key stored on the device.

What happened and who is affected

What happened

WatchGuard disclosed CVE-2025-14733, an out-of-bounds write in the Fireware OS iked process that lets a remote attacker without credentials run code on a Firebox using IKEv2 mobile VPN or branch office VPN with a dynamic peer. WatchGuard said threat actors were actively attempting to exploit it and published fixed releases for every supported branch the same day. Attackers who succeeded exfiltrated the Firebox configuration and local user database.

Who is affected

WatchGuard Firebox appliances on Fireware OS 2025.1 before 2025.1.4, 12.x before 12.11.6, 12.5.x before 12.5.15 (T15/T35) and 12.3.1 FIPS before 12.3.1_Update4, configured (now or previously) for IKEv2 mobile user VPN or IKEv2 branch office VPN to a dynamic gateway peer. Fireware 11.x is end of life.

CVE-2025-14733. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/watchguard-cve-2025-14733/

Affected products

  • WatchGuard Firebox (Fireware OS)
How we built this timeline

Zero-day acknowledged at disclosure with fixes for every supported branch. Date conflict: original advisory 'Published Date 18 Dec 2025'; new PSIRT site 'Published 19 Dec 2025';

CVE record 19 Dec 2025 (= 18 Dec 2025 16:01 US Pacific). Advisory-sourced moments use the advisory's own date (18 Dec 2025, day) since 23 Oct 2026 (R5).

KEV 19 Dec 2025 marks ransomware use Known. The old advisory URL (www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027) now redirects to the psirt.watchguard.com index; first-day content is cited from the Wayback snapshot.

Additional attacker IPs were added on 29 Dec 2025 and the advisory was last updated 10 Aug 2026. Same iked component as CVE-2025-9242 (watchguard-cve-2025-9242).

Related

WatchGuard report card