CISA Confirms Ransomware Exploitation of WatchGuard Firewall Flaw

Ransomware gangs are actively exploiting a critical remote code execution (RCE) vulnerability in WatchGuard Firebox firewalls, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed.

The flaw, tracked as CVE-2025-14733, involves an out-of-bounds write error that allows unauthenticated threat actors to execute malicious code. The exploitation is described as low-complexity, meaning attackers can target systems without requiring specialised access or high levels of technical sophistication.

Technical Impact and Affected Systems

The vulnerability affects firewalls running Fireware OS versions 11.x (including 11.12.4_Update1), 12.x (including 12.11.5), and versions 2025.1 through 2025.1.3.

WatchGuard has specified that unpatched Firebox firewalls are primarily at risk if they are configured to use IKEv2 VPN. However, the vendor warned that devices might remain vulnerable even if these configurations are removed, provided a branch office VPN to a static gateway peer is still active.

Active Exploitation and Patching Status

CISA first added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue in December. While security patches were released at that time, many devices remain exposed. Internet security watchdog group Shadowserver reported that over 115,000 unpatched Firebox firewalls were visible online in December, and approximately 9,000 of those remained unsecured nine months later.

This incident follows a pattern of similar vulnerabilities affecting the hardware. In September 2025, WatchGuard patched another RCE vulnerability, CVE-2025-9242, which shared almost identical characteristics with the current CVE-2025-14733 flaw.

Organisations utilising WatchGuard Firebox devices should immediately verify their firmware versions and ensure all applicable security updates have been applied to mitigate the risk of ransomware deployment.