WatchGuard Firebox CVE-2025-14733: Unauthenticated RCE via IKEv2 and Ransomware Exploitation

1. Basic Information

• Original Source: CISA: WatchGuard RCE flaw now exploited in ransomware attacks
• Publisher: BleepingComputer
• Publication Date: 2026-09-10
• Update Date: Not specified
• Severity: Critical
• Reason for Severity: It allows unauthenticated access to the perimeter Firebox, has confirmed active exploitation and ransomware use, and leads to the theft of configuration and secret information.
• Related Sources: WatchGuard PSIRT CVE-2025-14733, CISA KEV Catalog

2. Summary

CISA has updated its KEV entry for CVE-2025-14733 to state that an unauthenticated RCE vulnerability in the IKEv2 processing of WatchGuard Firebox is being used in ransomware attacks. Compromise cases confirm the exfiltration of configurations and local admin user databases.

3. Attack Flow

WatchGuard Firebox CVE-2025-14733: Unauthenticated RCE via IKEv2 and Ransomware Exploitation

• Attackers send crafted requests from the external network to the IKEv2 processing of a vulnerable Firebox. WatchGuard highlights abnormally large CERT payloads (certificate data) in IKE_AUTH requests as indicators of attack.
• They exploit an out-of-bounds write in the iked process, which handles VPN key exchange, to execute code without authentication.
• They encrypt the running configuration or pack the configuration and local admin user database into a gzip archive.
• They exfiltrate data to the same IP address as the attacker.
• CISA states that this vulnerability has been used in ransomware attacks, but the specific encryption steps have not been publicly disclosed.

4. Attacker Position and Execution Location

• An unauthenticated remote attacker who can reach the Firebox IKEv2 service.

5. Visibility for Victims and Administrators

Victims

• iked unresponsiveness or crashes may cause VPN connection establishment or key renewal to fail. Communication on existing tunnels may sometimes continue.

Administrators

• Diagnostic logs may show long certificate chains, large CERT payloads, or crash reports. Outbound traffic from the appliance to known attack IPs should be checked separately from incoming connections.

6. Success and Failure Conditions

Success Conditions

• The corresponding patched version of the Fireware OS series is not applied.
• Mobile User VPN using IKEv2, or Branch Office VPN using IKEv2 with dynamic gateway peers (connection settings without fixed peer IP addresses), is configured and reachable from the external network.
• Even if these configurations were deleted in the past, Branch Office VPNs using static gateway peers may still leave the system vulnerable.
• To proceed to data exfiltration, the attacker must be able to read configurations and other data after code execution and transmit them externally.

Failure Conditions and Risk Mitigation

• Update to the corresponding patched version. Restricting unnecessary exposure does not replace the update.
• For configurations using only static gateway peers that cannot be updated, review the conditions and procedures for applying the temporary workaround provided by WatchGuard.
• If a compromise is confirmed or suspected, preserve the configuration for investigation, and follow official procedures to rotate shared secrets, passwords, keys, and certificates within the Firebox.

7. What Happens Upon Success

• Unauthenticated code execution on the Firebox
• Theft of running configurations, the local admin user database, and stored secrets
• Disruption of VPN connections and key renewals. While use in ransomware attacks has been reported, individual follow-up steps are not publicly disclosed.

8. Observable Logs

Inference: Based on published attack behavior, this section organizes logs and collection conditions useful for investigation.

Email

• N/A.

Proxy / SWG / DNS

• Destination, timestamp, and transfer volume when outbound appliance traffic passes through monitored paths. Direct connections to IP addresses cannot be tracked by DNS logs alone.

Endpoint / EDR

• Instead of standard endpoint EDR, use Firebox iked diagnostic logs and crash reports. Default error levels may record certificate chains exceeding 8 certificates, while info levels may record CERT payloads exceeding 2,000 bytes.

Identity / IdP

• Firebox administrative authentication and configuration change records, as well as authentication logs of systems using credentials suspected of being compromised. Public information does not confirm unauthorized subsequent authentication in all cases.

SaaS / Cloud

• N/A.

Network

• External connections to IKEv2 and outbound traffic from the Firebox to known attack IPs or abnormal destinations. CERT size and certificate counts are indicators derived from appliance diagnostic logs and cannot be determined from communication metadata alone.

9. Determining Attack Success

• Successful Exploitation Reported: WatchGuard has reported the exfiltration of configuration files and other data after exploitation. However, merely observing long certificate chains, large CERT payloads, and iked crashes in your own organization does not confirm successful code execution.
• Confirmed Data Exfiltration or Session Compromise: WatchGuard has confirmed cases where encrypted running configurations were sent, and cases where configurations and local admin user databases were gzipped and sent. The destination in both cases is the same IP as the attacker. This reports configuration theft and does not necessarily indicate successful ransomware encryption in each case.

10. Investigation Playbook

Inference: The following outlines investigation steps if a similar attack is suspected in your organization.

Starting Point

• Start from a Firebox with a vulnerable configuration, iked anomalies, communication with known attack IPs, or unexplained VPN connection failures.

Initial Check

• Check the device model, Fireware OS version, current and past IKEv2 configurations, and external reachability, and cross-reference them with the vendor's product impact table.

Endpoint

• Before rebooting or updating, preserve diagnostic logs, crash reports, and configurations to the extent possible. Check the iked log collection level and retention period, and review certificate counts, CERT sizes, unresponsiveness, and crashes in chronological order.

Identity / Cloud

• Check for additions, modifications, and authentications of administrative accounts, and investigate whether shared secrets or credentials suspected of being compromised are used in other VPNs or systems.

Subsequent Investigation

• Check whether there was outbound traffic from the device before and after logs indicating an attack. If there are signs of unauthorized internal authentication or lateral movement, expand the investigation and do not determine subsequent damage based solely on KEV classification.

Containment

• Limit external reachability to the affected device and apply the corresponding patched version. If a compromise is confirmed or suspected, follow WatchGuard's procedures to rotate stored secrets and align settings on peer devices.

Assessment

• Record received attack requests, unauthorized actions within the device, configuration exfiltration, compromise of internal systems, and encryption damage separately by evidence. Do not determine success or failure based solely on iked crashes.

11. Defense and Detection Ideas

Inference: The following are detection and mitigation suggestions based on public information. Do not judge activity as malicious based on a single match alone; cross-reference it with normal business operations.

Single Event

• Check iked certificate count and CERT size indicators, as well as outbound traffic to known attack IPs. WatchGuard considers iked unresponsiveness a strong indicator and crashes a weak indicator that may have other causes.

Chronological Correlation

• Correlate suspicious requests to IKEv2, iked anomalies, outbound traffic from the device, and subsequent administrative authentication by device, source, and timestamp.

Threat Hunting

• Check not only current VPN configurations, but also the history of deleted Mobile User VPNs and dynamic gateway peers. Search diagnostic logs and outbound traffic during the impact period.

Log Gaps

• If iked info logs are not collected, historical CERT sizes may not be verifiable. Ensure that diagnostic logs and crash reports are retained and that outbound traffic from the appliance itself can be monitored.

Priority Actions

• Update to the corresponding patched version. Restricting unnecessary exposure does not replace the update.
• For configurations using only static gateway peers that cannot be updated, review the conditions and procedures for applying the temporary workaround provided by WatchGuard.
• If a compromise is confirmed or suspected, preserve the configuration for investigation, and follow official procedures to rotate shared secrets, passwords, keys, and certificates within the Firebox.

12. Facts / Inference / Hypothesis

Facts

• CVE-2025-14733 is an out-of-bounds write in the Fireware OS iked process that allows remote unauthenticated attackers to execute arbitrary code, with a CVSS v4.0 score of 9.3.
• Mobile User VPNs using IKEv2 or Branch Office VPNs using IKEv2 with dynamic gateway peers are affected. Even if these are deleted, Branch Office VPNs using static gateway peers may leave the system vulnerable.
• WatchGuard has confirmed active exploitation, noting instances where running configurations were encrypted and exfiltrated after compromise, as well as instances where configurations and local admin user databases were gzipped and exfiltrated.
• BleepingComputer reported on September 10, 2026, that CISA updated the existing KEV entry for CVE-2025-14733 to indicate known use in ransomware attacks. Victim organizations and subsequent encryption procedures have not been disclosed.
• WatchGuard indicates that certificate chains exceeding 8 certificates in default error logs are medium indicators of attack, and CERT payloads exceeding 2,000 bytes in info logs are strong indicators of attack. iked unresponsiveness is a strong indicator, and crashes are weak indicators that may have other causes.
• Patched versions include Fireware OS general series 2025.1.4 and 12.11.6, 12.5.15 for T15/T35, and 12.3.1-b728352 for FIPS. Impact determinations, including older 11.x series, follow product-specific tables. If a compromise is suspected, rotating secrets within the Firebox is required in addition to updating.

Inference

• Observable logs, investigation playbooks, and defense/detection ideas are proposals based on vendor indicators of attack and post-exploitation activity. Device anomalies, data exfiltration, and subsequent compromises should be evaluated with independent evidence.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

Inference: Mapping based on published behavior.

• T1190 Exploit Public-Facing Application (Confidence: High): Exploits externally reachable IKEv2 processing without authentication.
• T1005 Data from Local System (Confidence: High): Collects configurations and local admin user databases.
• T1560.001 Archive Collected Data: Archive via Utility (Confidence: High): Packages configurations and user databases into a gzip archive.

14. Unknowns and Further Investigation

• Victim organizations, threat actors, subsequent malware, and encryption procedures of the ransomware attacks.
• Observation periods for each IOC and attack infrastructure other than known IPs.
• Communication protocols used for exfiltration and their relationship to existing C2 channels. Even if the destination IP is the same as the attacker's, it cannot be concluded that they share the same channel.

15. Impact on SOCs and Organizations

Because the Firebox handles VPN and perimeter defense, it is necessary to verify and update affected versions and configurations, as well as check for signs of compromise. Because deleted VPN configurations affect impact assessment, it is important not to assume safety based solely on current settings. SOCs should correlate iked diagnostic logs with outbound traffic from the appliance, and if a compromise is suspected, investigate the potential impact scope if secrets within the configuration were exposed. The classification of ransomware usage should be handled separately from the damage stage confirmed by your own organization.

16. Summary by Role

• SOC: Correlates iked diagnostic logs, unresponsiveness/crashes, outbound traffic to known IPs, and subsequent administrative authentication to distinguish between attempts and configuration theft.
• Administrators: Update to patched versions and review past and present IKEv2 configurations. If a compromise is suspected, rotate all secrets within the Firebox.
• Users: Report continuous VPN reconnection failures or suspicious authentication notifications to administrators rather than attempting to apply workarounds independently.