Vulnerability-Lookup

CVE-2025-14733 (GCVE-0-2025-14733)

Vulnerability from cvelistv5 – Published: 2025-12-19 00:01 – Updated: 2026-08-10 19:36

CISA Previdian

Title

WatchGuard Firebox iked Out of Bounds Write Vulnerability

Summary

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-20 04:56 UTC

CWE

CWE-787

Assigner

WatchGuard mitre root

References

3 references

URL	Tags
https://psirt.watchguard.com/CVE-2025-14733	vendor-advisory
https://www.watchguard.com/wgrd-psirt/advisory/wg…	vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

3 products

Vendor	Product	Version	CPE status
WatchGuard	Fireware OS	Affected: 2025.1 , < 2025.1.4 (custom) Affected: 12.0 , < 12.11.6 (custom) Affected: 11.10.2 , ≤ 11.12.4+541730 (custom)	guessed
WatchGuard	Fireware OS	Affected: 12.0 , < 12.3.1+728352 (custom)	guessed
WatchGuard	Fireware OS	Affected: 12.0 , < 12.5.15 (custom)	guessed

Date Public

2025-12-19 00:01

Credits

Discovered internally by WatchGuard

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 70374d4d-1d1e-49da-ab57-40bfdd512fcb

Vulnerability ID: CVE-2025-14733

Status: Confirmed

Status Updated: 2025-12-19 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-12-19

Asserted: 2025-12-19

Scope

Notes: KEV entry: WatchGuard Firebox Out of Bounds Write Vulnerability | Affected: WatchGuard / Firebox | Description: WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2025-12-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14733

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-787
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Firebox
Due Date	2025-12-26
Date Added	2025-12-19
Vendorproject	WatchGuard
Vulnerabilityname	WatchGuard Firebox Out of Bounds Write Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2025-14733

Created: 2026-02-02 12:25 UTC | Updated: 2026-02-06 07:17 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 1487d53e-0e56-4c4c-929c-ce02b290afb9

Vulnerability ID: CVE-2025-14733

Status: Confirmed

Status Updated: 2026-06-01 10:46 UTC

Exploited: Yes

Timestamps

First Seen: 2026-06-01

Asserted: 2026-06-01

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	WatchGuard Firebox iked Out of Bounds Write Vulnerability
Vendor	WatchGuard
Product	Fireware OS
Added Date	2026-06-01T10:46:40.736Z
Cvss Score	9.3
Epss Score	0.17469
Cvss Severity	CRITICAL
Epss Percentile	0.96742
Used In Malware	unknown
Ahead Of Cisa Kev	`{ "count": 1, "unit": "day" }`
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14733",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-20T04:56:16.893498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-12-19",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:07:25.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-12-19T00:00:00.000Z",
            "value": "CVE-2025-14733 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Default"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "2025.1.4",
              "status": "affected",
              "version": "2025.1",
              "versionType": "custom"
            },
            {
              "lessThan": "12.11.6",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "11.12.4+541730",
              "status": "affected",
              "version": "11.10.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "FIPS"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.3.1+728352",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "T15/T35"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.5.15",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.3.1+728352",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.5.15",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2025.1.4",
                  "versionStartIncluding": "2025.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.11.6",
                  "versionStartIncluding": "12.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "11.12.4+541730",
                  "versionStartIncluding": "11.10.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Discovered internally by WatchGuard"
        }
      ],
      "datePublic": "2025-12-19T00:01:55.722Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003ePost-Exploit Activity\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIndicators of Attack\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\u003c/p\u003e\u003cp\u003e\u003cem\u003eIP Addresses\u003c/em\u003e\u003c/p\u003e\u003cp\u003eThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e45.95.19[.]50\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e51.15.17[.]89\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e172.93.107[.]67\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e199.247.7[.]82\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e38.252.8[.]14 - Added Dec 29\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e94.249.197[.]106 - Added Dec 29\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cem\u003eLogs\u003c/em\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eInvalid peer certificate chain\u003c/em\u003e\u003c/p\u003e\u003cp\u003eWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\u003c/p\u003e\u003cp\u003e\u003ccode\u003e1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1\u0026lt;-\u0026gt;203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\u003c/code\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eAbnormally large IKE_AUTH request CERT payload\u003c/em\u003e\u003c/p\u003e\u003cp\u003eWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\u003c/p\u003e\u003cp\u003e\u003ccode\u003e1970-01-01 01:00:00 iked (203.0.113.1\u0026lt;-\u0026gt;203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\u003c/code\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eDevice Behavior\u003c/em\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eIKE process hang\u003c/em\u003e\u003c/p\u003e\u003cp\u003eDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\u003c/p\u003e\u003cp\u003e\u003cem\u003eIKE process crash\u003c/em\u003e\u003c/p\u003e\u003cp\u003eAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.\u003c/p\u003e"
            }
          ],
          "value": "WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\nPost-Exploit Activity\nWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\nIndicators of Attack\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\nIP Addresses\nThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\n- 45.95.19[.]50\n- 51.15.17[.]89\n- 172.93.107[.]67\n- 199.247.7[.]82\n- 38.252.8[.]14 - Added Dec 29\n- 94.249.197[.]106 - Added Dec 29\nLogs\nInvalid peer certificate chain\nWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\n1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1\u003c-\u003e203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\nAbnormally large IKE_AUTH request CERT payload\nWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\n1970-01-01 01:00:00 iked (203.0.113.1\u003c-\u003e203.0.113.2)\"IKE_AUTH request\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\nDevice Behavior\nIKE process hang\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\nIKE process crash\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T19:36:36.734Z",
        "orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "shortName": "WatchGuard"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.watchguard.com/CVE-2025-14733"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our \u003ca href=\"https://techsearch.watchguard.com/KB?type=Article\u0026amp;SFDCID=kA1Vr000000DNMzKAO\u0026amp;lang=en_US\"\u003eBest Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article\u0026SFDCID=kA1Vr000000DNMzKAO\u0026lang=en_US)."
        }
      ],
      "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIf your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\u2019s recommendations for \u003ca href=\"https://techsearch.watchguard.com/KB?type=Article\u0026amp;SFDCID=kA1Vr000000DMXNKA4\u0026amp;lang=en_US\"\u003eSecure Access to Branch Office VPNs that Use IPSec and IKEv2\u003c/a\u003e as a temporary workaround.\u003c/p\u003e"
            }
          ],
          "value": "If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\u2019s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 (https://techsearch.watchguard.com/KB?type=Article\u0026SFDCID=kA1Vr000000DMXNKA4\u0026lang=en_US) as a temporary workaround."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
    "assignerShortName": "WatchGuard",
    "cveId": "CVE-2025-14733",
    "datePublished": "2025-12-19T00:01:55.722Z",
    "dateReserved": "2025-12-15T17:47:40.301Z",
    "dateUpdated": "2026-08-10T19:36:36.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2025-14733",
      "cwes": "[\"CWE-787\"]",
      "dateAdded": "2025-12-19",
      "dueDate": "2025-12-26",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14733",
      "product": "Firebox",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.",
      "vendorProject": "WatchGuard",
      "vulnerabilityName": "WatchGuard Firebox Out of Bounds Write Vulnerability"
    },
    "epss": {
      "cve": "CVE-2025-14733",
      "date": "2026-08-27",
      "epss": "0.2651",
      "percentile": "0.9786"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-14733\",\"sourceIdentifier\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"published\":\"2025-12-19T01:16:05.530\",\"lastModified\":\"2026-08-11T13:07:58.823\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\\n\\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.\"}],\"affected\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"affectedData\":[{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Default\"],\"versions\":[{\"version\":\"2025.1\",\"lessThan\":\"2025.1.4\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"12.0\",\"lessThan\":\"12.11.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"11.10.2\",\"lessThanOrEqual\":\"11.12.4+541730\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"FIPS\"],\"versions\":[{\"version\":\"12.0\",\"lessThan\":\"12.3.1+728352\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WatchGuard\",\"product\":\"Fireware OS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"T15/T35\"],\"versions\":[{\"version\":\"12.0\",\"lessThan\":\"12.5.15\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"RED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-12-20T04:56:16.893498Z\",\"id\":\"CVE-2025-14733\",\"options\":[{\"exploitation\":\"active\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"cisaExploitAdd\":\"2025-12-19\",\"cisaActionDue\":\"2025-12-26\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"WatchGuard Firebox Out of Bounds Write Vulnerability\",\"weaknesses\":[{\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.10.2\",\"versionEndExcluding\":\"12.5.15\",\"matchCriteriaId\":\"C506DA98-651D-4EA6-BEAE-4E5E69841E0F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC78E84B-C17B-44C5-9427-5EF97B90A6EF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12FED793-9DF3-46BB-AA64-3B1934123616\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.10.2\",\"versionEndExcluding\":\"12.11.6\",\"matchCriteriaId\":\"9C81D87D-AB69-48F3-B780-1DB762865AB5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB00A42A-2065-4914-80CA-981E62DEC2CC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FC5E2C2-B0E3-4879-9B7C-E6E84A7BEC4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22AC145E-2F33-4C0D-AA78-080CEA1980AB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F83640-57E7-4DF8-A201-E8D5722EF978\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F639188-7E3D-46B8-8443-5B1F32A3EC59\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB643AE5-6432-474F-BCF9-7A92B907EDE1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08FC5CE7-00F5-40C4-877F-78D3DF6B01DC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04B14406-F7EC-4573-8AF0-BCCBA9BD1A15\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D10EFE3-0342-4670-AC73-011D08A4CBEA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68953F7A-9037-4848-9F7B-FD8E798CB761\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A49CF31-D888-4DAE-B1D4-2E4E5A98B38A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F14FE4A-4C09-4B2E-8D2C-ECA03FC62595\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"413CB88D-9755-43BF-9D76-4252C7151A84\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"902C261B-AE76-4F2A-B660-2C069692E95D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3781D2E-80EF-4F6C-BBC3-7570940A5EBF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D5FBFA4-219F-49F8-BD2C-415A621F6ED6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"157A59B2-F420-4203-92C4-412685C51893\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFD1036B-87F5-4523-B67C-0DE6E9AACE32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA4FE4DD-A364-4D3C-B84A-516AFC05F5A4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8050A99B-C106-422D-9497-5E7C79FB89E0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F2A1048-7830-4CEB-B6D1-4A4F0C10580F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F97AE5A0-E6E5-46BD-B05D-98E4253773F7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD55ABF8-7C3C-476C-9A04-C889F3D8A21E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9882123D-992F-4BDA-8EE0-433A3AF62B54\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D86B0B2-D05B-4361-A02A-C1FEE2F710DD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2025.1\",\"versionEndExcluding\":\"2025.1.4\",\"matchCriteriaId\":\"D89FF95E-552C-4264-94F9-F7D50FE002FA\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"615FF2CF-69DA-4890-9236-52D8D6FA0E71\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3439409-2FD6-447B-91CF-17D1C09E2A79\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"575CC5EE-0278-489B-AA95-5EC5058D6FB9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5597F672-3C72-4BCF-AD3F-F16B6913EC2F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E28F563C-BC6E-41FB-8C62-F56CC539D4DD\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2296AE00-4806-484D-BD1D-B58A8FB87CE0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9071315-92A1-45FA-A048-BB750A40EF76\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A435F5A-752F-44D7-8083-0C2670F26689\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"591A04F9-FF92-4484-91DC-F268805A8708\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49672197-C3FA-42A5-A550-DCA5ED89D0FA\"}]}]}],\"references\":[{\"url\":\"https://psirt.watchguard.com/CVE-2025-14733\",\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027\",\"source\":\"5d1c2695-1a31-4499-88ae-e847036fd7e3\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:58:57+00:00",
      "cve": "CVE-2025-14733",
      "id": "CVE-2025-14733",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "WatchGuard Firebox iked Out of Bounds Write Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14733.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14733\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-12-20T04:56:16.893498Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-12-19\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-12-19T00:00:00.000Z\", \"value\": \"CVE-2025-14733 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-12-19T13:47:26.170Z\"}}], \"cna\": {\"title\": \"WatchGuard Firebox iked Out of Bounds Write Vulnerability\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Discovered internally by WatchGuard\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.3, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red\"}}], \"affected\": [{\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025.1\", \"lessThan\": \"2025.1.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.11.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"11.10.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"11.12.4+541730\"}], \"platforms\": [\"Default\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.3.1+728352\", \"versionType\": \"custom\"}], \"platforms\": [\"FIPS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WatchGuard\", \"product\": \"Fireware OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0\", \"lessThan\": \"12.5.15\", \"versionType\": \"custom\"}], \"platforms\": [\"T15/T35\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\\nPost-Exploit Activity\\nWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\\nIndicators of Attack\\nWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\\nIP Addresses\\nThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\\n- 45.95.19[.]50\\n- 51.15.17[.]89\\n- 172.93.107[.]67\\n- 199.247.7[.]82\\n- 38.252.8[.]14 - Added Dec 29\\n- 94.249.197[.]106 - Added Dec 29\\nLogs\\nInvalid peer certificate chain\\nWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\\n1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1\u003c-\u003e203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\\nAbnormally large IKE_AUTH request CERT payload\\nWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\\n1970-01-01 01:00:00 iked (203.0.113.1\u003c-\u003e203.0.113.2)\\\"IKE_AUTH request\\\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\\nDevice Behavior\\nIKE process hang\\nDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\\nIKE process crash\\nAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eWatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003ePost-Exploit Activity\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eWe have identified two variants of post-exploit activity targeting exposed Firebox appliances. In one variant, the threat actor encrypts and then exfiltrates the active configuration file from the Firebox to the same IP address that the attack originates from. In the second variant, the threat actor creates a gzip archive with both the active configuration file and the local management user database and exfiltrates the archive to the same IP address that the attack originates from. In all instances where a successful exploit is suspected, Firebox administrators should follow the remediation guidance described below and rotate all secrets stored on the Firebox.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eIndicators of Attack\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eWe are providing the following Indicators of Attack (IoAs) to help device owners identify potential attempts to exploit this vulnerability against vulnerable Firebox appliances. These IoAs are only applicable on devices that lack the resolution described later in this advisory.\u003c/p\u003e\u003cp\u003e\u003cem\u003eIP Addresses\u003c/em\u003e\u003c/p\u003e\u003cp\u003eThe following IP addresses are directly associated with known threat actor activity. Outbound connections to these IPs are a strong indicator of compromise. Inbound connections from these IPs could indicate reconnaissance efforts or exploit attempts.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e45.95.19[.]50\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e51.15.17[.]89\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e172.93.107[.]67\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e199.247.7[.]82\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e38.252.8[.]14 - Added Dec 29\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e94.249.197[.]106 - Added Dec 29\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cem\u003eLogs\u003c/em\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eInvalid peer certificate chain\u003c/em\u003e\u003c/p\u003e\u003cp\u003eWith the iked diagnostic logging set to the default error logging level, the iked process generates a log message when the Firebox receives an IKE2 Auth payload with more than 8 certificates. This is a medium indicator of attack that the WatchGuard Threat Lab has observed associated with some threat actor activity.\u003c/p\u003e\u003cp\u003e\u003ccode\u003e1970-01-01 01:00:00 2025 Firebox-Name local3.err iked[2938]: (203.0.113.1\u0026lt;-\u0026gt;203.0.113.2) Received peer certificate chain is longer than 8. Reject this certificate chain\u003c/code\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eAbnormally large IKE_AUTH request CERT payload\u003c/em\u003e\u003c/p\u003e\u003cp\u003eWith the iked diagnostic logging set to the info logging level, the iked process generates a log message when the Firebox receives an IKE_AUTH request message. An IKE_AUTH request log message with an abnormally large CERT payload size (greater than 2000 bytes) is a strong indicator of an attack. This is a strong indicator of attack.\u003c/p\u003e\u003cp\u003e\u003ccode\u003e1970-01-01 01:00:00 iked (203.0.113.1\u0026lt;-\u0026gt;203.0.113.2)\\\"IKE_AUTH request\\\" message has 6 payloads [ IDi(sz=21) CERT(sz=3000) SA(sz=44) TSi(sz=24) TSr(sz=24) N(sz=8)]\u003c/code\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eDevice Behavior\u003c/em\u003e\u003c/p\u003e\u003cp\u003e\u003cem\u003eIKE process hang\u003c/em\u003e\u003c/p\u003e\u003cp\u003eDuring a successful exploit, the IKED process (responsible for handling IKE negotiations) will hang, interrupting VPN tunnel negotiations and re-keys. This is a strong indicator of attack. Existing tunnels may continue to pass traffic.\u003c/p\u003e\u003cp\u003e\u003cem\u003eIKE process crash\u003c/em\u003e\u003c/p\u003e\u003cp\u003eAfter a failed or successful exploit, the IKED process will crash and generate a fault report on the Firebox. Be aware, there are other situations that could cause the IKED process to crash. This is a weak indicator of attack.\u003c/p\u003e\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Fireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our Best Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article (https://techsearch.watchguard.com/KB?type=Article\u0026SFDCID=kA1Vr000000DNMzKAO\u0026lang=en_US).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFireware OS 2025.1.4, Fireware OS 12.11.6, Fireware OS 12.5.15, Fireware OS 12.3.1-b728352 In addition to installing the latest Fireware OS that contains the fix, administrators that have confirmed threat actor activity on their Firebox appliances must take precautions to rotate all locally stored secrets on vulnerable Firebox appliances as described in our \u003ca href=\\\"https://techsearch.watchguard.com/KB?type=Article\u0026amp;SFDCID=kA1Vr000000DNMzKAO\u0026amp;lang=en_US\\\"\u003eBest Practices to Rotate Shared Secrets Stored on the Firebox knowledge base article\u003c/a\u003e.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2025-12-19T00:01:55.722Z\", \"references\": [{\"url\": \"https://psirt.watchguard.com/CVE-2025-14733\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\\u2019s recommendations for Secure Access to Branch Office VPNs that Use IPSec and IKEv2 (https://techsearch.watchguard.com/KB?type=Article\u0026SFDCID=kA1Vr000000DMXNKA4\u0026lang=en_US) as a temporary workaround.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIf your Firebox is only configured with Branch Office VPN tunnels to static gateway peers and you are not able to immediately upgrade the device to a version of Fireware OS with the vulnerability resolution, you can follow WatchGuard\\u2019s recommendations for \u003ca href=\\\"https://techsearch.watchguard.com/KB?type=Article\u0026amp;SFDCID=kA1Vr000000DMXNKA4\u0026amp;lang=en_US\\\"\u003eSecure Access to Branch Office VPNs that Use IPSec and IKEv2\u003c/a\u003e as a temporary workaround.\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\\n\\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.3.1+728352\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.5.15\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2025.1.4\", \"versionStartIncluding\": \"2025.1\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"12.11.6\", \"versionStartIncluding\": \"12.0\"}, {\"criteria\": \"cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"11.12.4+541730\", \"versionStartIncluding\": \"11.10.2\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"shortName\": \"WatchGuard\", \"dateUpdated\": \"2026-08-10T19:36:36.734Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-14733\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T19:36:36.734Z\", \"dateReserved\": \"2025-12-15T17:47:40.301Z\", \"assignerOrgId\": \"5d1c2695-1a31-4499-88ae-e847036fd7e3\", \"datePublished\": \"2025-12-19T00:01:55.722Z\", \"assignerShortName\": \"WatchGuard\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2025-16142

Vulnerability from fstec - Published: 18.12.2025

Title

Уязвимость демона iked операционной системы WatchGuard Fireware OS, позволяющая нарушителю выполнить произвольный код

Description

Уязвимость демона iked операционной системы WatchGuard Fireware OS связана с записью за границами буфера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


                    
                      AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vendor

Watchguard Technologies Inc.

Software Name

Fireware OS

Software Version

от 2025.1 до 2025.1.4 (Fireware OS), от 11.10.2 до 11.12.4_Update1 включительно (Fireware OS), от 12.0 до 12.11.6 (Fireware OS), от 12.5 до 12.5.15 (Fireware OS), от 12.3.1 до 12.3.1_Update4 (Fireware OS)

Possible Mitigations

Установка обновлений из доверенных источников. В связи со сложившейся обстановкой и введенными санкциями против Российской Федерации рекомендуется устанавливать обновления программного обеспечения только после оценки всех сопутствующих рисков. Компенсирующие меры: - использование средств межсетевого экранирования для ограничения удалённого доступа к уязвимому программному обеспечению; - ограничение доступа к уязвимому программному обеспечению, используя схему доступа по «белым спискам»; - использование систем обнаружения и предотвращения вторжений для отслеживания индикаторов компрометации для попыток эксплуатации уязвимости; - ограничение доступа к устройству из внешних сетей (Интернет). Использование рекомендаций производителя: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027

Reference

https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027

CWE

CWE-787

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": "AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Watchguard Technologies Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 2025.1 \u0434\u043e 2025.1.4 (Fireware OS), \u043e\u0442 11.10.2 \u0434\u043e 11.12.4_Update1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Fireware OS), \u043e\u0442 12.0 \u0434\u043e 12.11.6 (Fireware OS), \u043e\u0442 12.5 \u0434\u043e 12.5.15 (Fireware OS), \u043e\u0442 12.3.1 \u0434\u043e 12.3.1_Update4 (Fireware OS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0445\u0435\u043c\u0443 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e \u00ab\u0431\u0435\u043b\u044b\u043c \u0441\u043f\u0438\u0441\u043a\u0430\u043c\u00bb;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "18.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "22.12.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.12.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-16142",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-14733",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Fireware OS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Watchguard Technologies Inc. Fireware OS \u043e\u0442 2025.1 \u0434\u043e 2025.1.4 , Watchguard Technologies Inc. Fireware OS \u043e\u0442 11.10.2 \u0434\u043e 11.12.4_Update1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Watchguard Technologies Inc. Fireware OS \u043e\u0442 12.0 \u0434\u043e 12.11.6 , Watchguard Technologies Inc. Fireware OS \u043e\u0442 12.5 \u0434\u043e 12.5.15 , Watchguard Technologies Inc. Fireware OS \u043e\u0442 12.3.1 \u0434\u043e 12.3.1_Update4 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0435\u043c\u043e\u043d\u0430 iked \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b WatchGuard Fireware OS, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0417\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 (CWE-787)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0435\u043c\u043e\u043d\u0430 iked \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b WatchGuard Fireware OS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-787",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,3)"
}

FKIE_CVE-2025-14733

Vulnerability from fkie_nvd - Published: 2025-12-19 01:16 - Updated: 2026-08-11 13:07

CISA Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
5d1c2695-1a31-4499-88ae-e847036fd7e3	https://psirt.watchguard.com/CVE-2025-14733	Broken Link
5d1c2695-1a31-4499-88ae-e847036fd7e3	https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733	US Government Resource

Impacted products

Vendor	Product	Version
watchguard	fireware	*
watchguard	firebox_t15	*
watchguard	firebox_t35	*
watchguard	fireware	*
watchguard	firebox_m270	*
watchguard	firebox_m290	*
watchguard	firebox_m370	*
watchguard	firebox_m390	*
watchguard	firebox_m440	*
watchguard	firebox_m4600	*
watchguard	firebox_m470	*
watchguard	firebox_m4800	*
watchguard	firebox_m5600	*
watchguard	firebox_m570	*
watchguard	firebox_m5800	*
watchguard	firebox_m590	*
watchguard	firebox_m670	*
watchguard	firebox_m690	*
watchguard	firebox_nv5	*
watchguard	firebox_t20	*
watchguard	firebox_t25	*
watchguard	firebox_t40	*
watchguard	firebox_t45	*
watchguard	firebox_t55	*
watchguard	firebox_t70	*
watchguard	firebox_t80	*
watchguard	firebox_t85	*
watchguard	fireboxcloud	*
watchguard	fireboxv	*
watchguard	fireware	*
watchguard	firebox_m295	-
watchguard	firebox_m395	-
watchguard	firebox_m495	-
watchguard	firebox_m595	-
watchguard	firebox_m695	-
watchguard	firebox_t115-w	*
watchguard	firebox_t125	*
watchguard	firebox_t125-w	*
watchguard	firebox_t145	*
watchguard	firebox_t145-w	*
watchguard	firebox_t185	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Default"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "2025.1.4",
              "status": "affected",
              "version": "2025.1",
              "versionType": "custom"
            },
            {
              "lessThan": "12.11.6",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "11.12.4+541730",
              "status": "affected",
              "version": "11.10.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "FIPS"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.3.1+728352",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "T15/T35"
          ],
          "product": "Fireware OS",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "12.5.15",
              "status": "affected",
              "version": "12.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"
    }
  ],
  "cisaActionDue": "2025-12-26",
  "cisaExploitAdd": "2025-12-19",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "WatchGuard Firebox Out of Bounds Write Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C506DA98-651D-4EA6-BEAE-4E5E69841E0F",
              "versionEndExcluding": "12.5.15",
              "versionStartIncluding": "11.10.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t15:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC78E84B-C17B-44C5-9427-5EF97B90A6EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t35:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "12FED793-9DF3-46BB-AA64-3B1934123616",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C81D87D-AB69-48F3-B780-1DB762865AB5",
              "versionEndExcluding": "12.11.6",
              "versionStartIncluding": "11.10.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m270:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB00A42A-2065-4914-80CA-981E62DEC2CC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m290:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FC5E2C2-B0E3-4879-9B7C-E6E84A7BEC4E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m370:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "22AC145E-2F33-4C0D-AA78-080CEA1980AB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m390:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F83640-57E7-4DF8-A201-E8D5722EF978",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m440:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F639188-7E3D-46B8-8443-5B1F32A3EC59",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m4600:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB643AE5-6432-474F-BCF9-7A92B907EDE1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m470:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FC5CE7-00F5-40C4-877F-78D3DF6B01DC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m4800:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "04B14406-F7EC-4573-8AF0-BCCBA9BD1A15",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m5600:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D10EFE3-0342-4670-AC73-011D08A4CBEA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m570:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "68953F7A-9037-4848-9F7B-FD8E798CB761",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m5800:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A49CF31-D888-4DAE-B1D4-2E4E5A98B38A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m590:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F14FE4A-4C09-4B2E-8D2C-ECA03FC62595",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m670:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "413CB88D-9755-43BF-9D76-4252C7151A84",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m690:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "902C261B-AE76-4F2A-B660-2C069692E95D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_nv5:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3781D2E-80EF-4F6C-BBC3-7570940A5EBF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t20:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D5FBFA4-219F-49F8-BD2C-415A621F6ED6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t25:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "157A59B2-F420-4203-92C4-412685C51893",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t40:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFD1036B-87F5-4523-B67C-0DE6E9AACE32",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t45:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA4FE4DD-A364-4D3C-B84A-516AFC05F5A4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t55:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8050A99B-C106-422D-9497-5E7C79FB89E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t70:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F2A1048-7830-4CEB-B6D1-4A4F0C10580F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t80:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F97AE5A0-E6E5-46BD-B05D-98E4253773F7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t85:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD55ABF8-7C3C-476C-9A04-C889F3D8A21E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:fireboxcloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9882123D-992F-4BDA-8EE0-433A3AF62B54",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:fireboxv:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D86B0B2-D05B-4361-A02A-C1FEE2F710DD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:watchguard:fireware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D89FF95E-552C-4264-94F9-F7D50FE002FA",
              "versionEndExcluding": "2025.1.4",
              "versionStartIncluding": "2025.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m295:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "615FF2CF-69DA-4890-9236-52D8D6FA0E71",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m395:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3439409-2FD6-447B-91CF-17D1C09E2A79",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m495:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0C0412F-AB02-4D13-B159-D0FCD2ECA3ED",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m595:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "575CC5EE-0278-489B-AA95-5EC5058D6FB9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_m695:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5597F672-3C72-4BCF-AD3F-F16B6913EC2F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t115-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E28F563C-BC6E-41FB-8C62-F56CC539D4DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t125:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2296AE00-4806-484D-BD1D-B58A8FB87CE0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t125-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9071315-92A1-45FA-A048-BB750A40EF76",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t145:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A435F5A-752F-44D7-8083-0C2670F26689",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t145-w:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "591A04F9-FF92-4484-91DC-F268805A8708",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:watchguard:firebox_t185:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "49672197-C3FA-42A5-A550-DCA5ED89D0FA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured."
    }
  ],
  "id": "CVE-2025-14733",
  "lastModified": "2026-08-11T13:07:58.823",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "RED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14733",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-20T04:56:16.893498Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-19T01:16:05.530",
  "references": [
    {
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "tags": [
        "Broken Link"
      ],
      "url": "https://psirt.watchguard.com/CVE-2025-14733"
    },
    {
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733"
    }
  ],
  "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
      "type": "Secondary"
    }
  ]
}

GHSA-HV82-JJ64-JF47

Vulnerability from github – Published: 2025-12-19 03:31 – Updated: 2026-08-10 21:31

Details

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-14733"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-19T01:16:05Z",
    "severity": "CRITICAL"
  },
  "details": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.",
  "id": "GHSA-hv82-jj64-jf47",
  "modified": "2026-08-10T21:31:54Z",
  "published": "2025-12-19T03:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14733"
    },
    {
      "type": "WEB",
      "url": "https://psirt.watchguard.com/CVE-2025-14733"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14733"
    },
    {
      "type": "WEB",
      "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

NCSC-2025-0400

Vulnerability from csaf_ncscnl - Published: 2025-12-19 11:16 - Updated: 2025-12-19 11:16

Summary

Kwetsbaarheid verholpen in WatchGuard Firebox

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Er is een kwetsbaarheid verholpen in WatchGuard Fireware OS.

Interpretaties: Er is een kwetsbaarheid verholpen in WatchGuard Fireware OS. De kwetsbaarheid CVE-2025-14733 betreft een out-of-bounds write in het iked-proces van Fireware OS en treft zowel de Mobile User VPN (IKEv2) als de Branch Office VPN (IKEv2) wanneer deze is geconfigureerd met een dynamische gateway-peer. De kwetsbaarheid stelt een niet-geauthenticeerde aanvaller op afstand in staat om willekeurige code uit te voeren. Als de WatchGuard Firebox eerder is geconfigureerd met een Mobile User VPN (IKEv2) of Branch Office VPN (IKEv2) naar een dynamische gateway-peer, en beide configuraties inmiddels zijn verwijderd, kan het systeem alsnog kwetsbaar zijn indien er nog steeds een Branch Office VPN naar een statische gateway-peer is geconfigureerd. WatchGuard heeft pogingen tot misbruik van de kwetsbaarheid waargenomen.

Oplossingen: WatchGuard heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Voor bepaalde situaties waarin updaten niet direct mogelijk is heeft WatchGuard mitigerende maatregelen beschikbaar gesteld. Zie bijgevoegde referenties voor meer informatie. Controleer de omgeving op aanwezigheid van de indicatoren genoemd door beveiligingsbedrijf WatchGuard, die kunnen namelijk duiden op misbruik van de kwetsbaarheid. Bij aanwezigheid van de IOC's adviseert WatchGuard om alle lokaal opgeslagen secrets op kwetsbare Firebox apparaten te roteren. Zie bijgevoegde referenties voor meer informatie.

Kans: high

Schade: high

CWE-787: Out-of-bounds Write

CVE-2025-14733

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may enable remote unauthenticated attackers to execute arbitrary code, impacting specific VPN configurations across various software versions.

CWE-787 - Out-of-bounds Write

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
vers:unknown/* WatchGuard / Fireware OS		vers:unknown/*

References

2 references

URL	Category
https://www.watchguard.com/wgrd-psirt/advisory/wg…	external
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Er is een kwetsbaarheid verholpen in WatchGuard Fireware OS.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Er is een kwetsbaarheid verholpen in WatchGuard Fireware OS. De kwetsbaarheid CVE-2025-14733 betreft een out-of-bounds write in het iked-proces van Fireware OS en treft zowel de Mobile User VPN (IKEv2) als de Branch Office VPN (IKEv2) wanneer deze is geconfigureerd met een dynamische gateway-peer. De kwetsbaarheid stelt een niet-geauthenticeerde aanvaller op afstand in staat om willekeurige code uit te voeren.\n\nAls de WatchGuard Firebox eerder is geconfigureerd met een Mobile User VPN (IKEv2) of Branch Office VPN (IKEv2) naar een dynamische gateway-peer, en beide configuraties inmiddels zijn verwijderd, kan het systeem alsnog kwetsbaar zijn indien er nog steeds een Branch Office VPN naar een statische gateway-peer is geconfigureerd.\n\nWatchGuard heeft pogingen tot misbruik van de kwetsbaarheid waargenomen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "WatchGuard heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Voor bepaalde situaties waarin updaten niet direct mogelijk is heeft WatchGuard mitigerende maatregelen beschikbaar gesteld. Zie bijgevoegde referenties voor meer informatie.\n\nControleer de omgeving op aanwezigheid van de indicatoren genoemd door beveiligingsbedrijf WatchGuard, die kunnen namelijk duiden op misbruik van de kwetsbaarheid. Bij aanwezigheid van de IOC\u0027s adviseert WatchGuard om alle lokaal opgeslagen secrets op kwetsbare Firebox apparaten te roteren. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
      }
    ],
    "title": "Kwetsbaarheid verholpen in WatchGuard Firebox",
    "tracking": {
      "current_release_date": "2025-12-19T11:16:01.438518Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2025-0400",
      "initial_release_date": "2025-12-19T11:16:01.438518Z",
      "revision_history": [
        {
          "date": "2025-12-19T11:16:01.438518Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Fireware OS"
          }
        ],
        "category": "vendor",
        "name": "WatchGuard"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14733",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may enable remote unauthenticated attackers to execute arbitrary code, impacting specific VPN configurations across various software versions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-14733 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14733.json"
        }
      ],
      "title": "CVE-2025-14733"
    }
  ]
}

WID-SEC-W-2025-2902

Vulnerability from csaf_certbund - Published: 2025-12-18 23:00 - Updated: 2025-12-18 23:00

Summary

WatchGuard Firebox OS (iked process): Schwachstelle ermöglicht Codeausführung

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WatchGuard Firebox OS ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2025-14733

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
WatchGuard Firebox OS <12.11.6 WatchGuard / Firebox		OS <12.11.6
WatchGuard Firebox OS <2025.1.4 WatchGuard / Firebox		OS <2025.1.4
WatchGuard Firebox OS <12.3.1_Update4 (B728352) WatchGuard / Firebox		OS <12.3.1_Update4 (B728352)
WatchGuard Firebox OS <12.5.15 WatchGuard / Firebox		OS <12.5.15

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.watchguard.com/wgrd-psirt/advisory/wg…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "WatchGuard Firebox ist ein Firewall bzw. Unified Threat Management Produkt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WatchGuard Firebox OS ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2902 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2902.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2902 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2902"
      },
      {
        "category": "external",
        "summary": "Watchguard Security Advisory vom 2025-12-18",
        "url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"
      }
    ],
    "source_lang": "en-US",
    "title": "WatchGuard Firebox OS (iked process): Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2025-12-18T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-19T11:54:57.039+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2902",
      "initial_release_date": "2025-12-18T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-12-18T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "OS \u003c2025.1.4",
                "product": {
                  "name": "WatchGuard Firebox OS \u003c2025.1.4",
                  "product_id": "T049597"
                }
              },
              {
                "category": "product_version",
                "name": "OS 2025.1.4",
                "product": {
                  "name": "WatchGuard Firebox OS 2025.1.4",
                  "product_id": "T049597-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:watchguard:firebox:os__2025.1.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "OS \u003c12.11.6",
                "product": {
                  "name": "WatchGuard Firebox OS \u003c12.11.6",
                  "product_id": "T049598"
                }
              },
              {
                "category": "product_version",
                "name": "OS 12.11.6",
                "product": {
                  "name": "WatchGuard Firebox OS 12.11.6",
                  "product_id": "T049598-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:watchguard:firebox:os__12.11.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "OS \u003c12.5.15",
                "product": {
                  "name": "WatchGuard Firebox OS \u003c12.5.15",
                  "product_id": "T049599"
                }
              },
              {
                "category": "product_version",
                "name": "OS 12.5.15",
                "product": {
                  "name": "WatchGuard Firebox OS 12.5.15",
                  "product_id": "T049599-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:watchguard:firebox:os__12.5.15"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "OS \u003c12.3.1_Update4 (B728352)",
                "product": {
                  "name": "WatchGuard Firebox OS \u003c12.3.1_Update4 (B728352)",
                  "product_id": "T049600"
                }
              },
              {
                "category": "product_version",
                "name": "OS 12.3.1_Update4 (B728352)",
                "product": {
                  "name": "WatchGuard Firebox OS 12.3.1_Update4 (B728352)",
                  "product_id": "T049600-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:watchguard:firebox:os__12.3.1_update4_%2528b728352%2529"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Firebox"
          }
        ],
        "category": "vendor",
        "name": "WatchGuard"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14733",
      "product_status": {
        "known_affected": [
          "T049598",
          "T049597",
          "T049600",
          "T049599"
        ]
      },
      "release_date": "2025-12-18T23:00:00.000+00:00",
      "title": "CVE-2025-14733"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-14733 (GCVE-0-2025-14733)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

BDU:2025-16142

FKIE_CVE-2025-14733

GHSA-HV82-JJ64-JF47

NCSC-2025-0400

WID-SEC-W-2025-2902

Tags

Sightings

Nomenclature