CVE-2025-14733 is a critical, unauthenticated remote code execution vulnerability in the "iked" process of WatchGuard Fireware OS, publicly disclosed by WatchGuard on 19 December 2025 (WatchGuard Security Advisory WGSA-2025-00027) after active exploitation was already underway. The flaw affects IKEv2 processing for both Mobile User VPN and Branch Office VPN when configured with dynamic gateway peers.

The following version(s) are affected:

Fireware OS 11.10.2 through 11.12.4_Update1 (end-of-life, no patch available), 12.0 through 12.11.5, 12.5.x (T15/T35 models) through 12.5.14, and 2025.1 through 2025.1.3 – (Affected)
Fireware OS 2025.1.4, 12.11.6, 12.5.15 (T15/T35 models), and 12.3.1_Update4 (FIPS-certified) and later – (Not affected, patched)

Upgrade Fireware OS to the fixed version for your branch (2025.1.4, 12.11.6, 12.5.15, or 12.3.1_Update4) without delay, per WatchGuard Security Advisory WGSA-2025-00027.

Typical attack flow:

1. Send a crafted IKE_AUTH request to the Firebox's IKEv2 VPN service — A remote, unauthenticated attacker sends a specially crafted IKE_AUTH request to a Firebox configured for Mobile User VPN or Branch Office VPN with dynamic gateway peers over IKEv2.
2. Trigger an out-of-bounds write and execute arbitrary code — The crafted request triggers an out-of-bounds write in the "iked" process, allowing the attacker to execute arbitrary code on the Firebox appliance without any authentication.

Attack vectors:

• A network-based, unauthenticated attack against any WatchGuard Firebox with Mobile User VPN or Branch Office VPN configured over IKEv2 with dynamic gateway peers, reachable from an untrusted network - most critically the public internet.
• No user interaction or privileges are required. This is confirmed under active exploitation from the moment of disclosure, is listed in CISA's KEV catalog, and continues to be flagged in Shadowserver's internet-wide scanning feed. This is not a theoretical risk, and any unpatched, internet-reachable Firebox should be treated as a plausible target.

Successful exploitation may allow attackers to:

• Execute arbitrary code on a WatchGuard Firebox appliance, without any authentication, via a single crafted IKEv2 request.
• Compromise the perimeter firewall/VPN gateway itself and use it as a foothold to intercept or manipulate traffic, and pivot into the wider internal network the Firebox protects.

CERTVU recommends the following:

1. Apply the Vendor Patch Immediately

   Upgrade Fireware OS to 2025.1.4, 12.11.6, 12.5.15, or 12.3.1_Update4 (matching your current branch) as an emergency change, given confirmed active exploitation.

2. Restrict or Disable IKEv2 VPN With Dynamic Gateway Peers

   Restrict or disable IKEv2 VPN with dynamic gateway peers where patching must be delayed.

Report any suspected compromise of a WatchGuard Firebox appliance to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.