CISA: WatchGuard Firebox Flaw Now Exploited by Ransomware Gangs Too

The US Cybersecurity and Infrastructure Security Agency (CISA) has reported that a critical vulnerability in WatchGuard Firebox firewalls is now being exploited by ransomware gangs. Earlier, in December, the agency had already flagged the flaw as being actively used in attacks.

What the vulnerability is

The issue has been assigned the identifier CVE-2025-14733 and involves an out-of-bounds write. It allows an unauthenticated attacker to remotely execute arbitrary code, and the attacks are low in complexity. At risk are devices running Fireware OS versions 11.x and above (including 11.12.4_Update1), 12.x and above (including 12.11.5), and 2025.1 through 2025.1.3.

When the patches were released in December, WatchGuard clarified that only firewalls configured to use IKEv2 VPN are vulnerable. However, a compromise is also possible if the vulnerable configuration has been removed but a branch-office VPN tunnel to a static gateway peer remains in place. The vendor confirmed that attacks had taken place and published indicators of compromise so that customers could check their devices.

The scale of the threat

According to the Shadowserver monitoring group, more than 115,000 unpatched Firebox devices were reachable online in December. Nine months on, nearly 9,000 instances remain unprotected.

In Thursday's update to the Known Exploited Vulnerabilities (KEV) catalog, CISA noted that CVE-2025-14733 is now being used by ransomware operators, though it did not disclose details of the attacks. The flaw was first added to the catalog in December — at which point the agency directed US federal agencies to remediate it within a week under Binding Operational Directive BOD 22-01.

Not the first time

Problems with WatchGuard equipment are nothing new. Two years ago, CISA required government agencies to close another actively exploited Firebox and XTM vulnerability (CVE-2022-23176). And in September 2025 the company fixed an RCE flaw, CVE-2025-9242, almost identical to the current one: a month later CISA flagged it as being used in attacks, and Shadowserver found more than 75,000 vulnerable devices.

WatchGuard serves more than 250,000 small and medium-sized businesses through a network of over 17,000 resellers and service providers worldwide, so any flaw in its products potentially affects a huge number of organizations.

Source: Bleeping Computer