watchguard firebox ikev2 flaw exploited, tied to ransomware

what happened

• WatchGuard published CVE-2025-14733 on 2025-12-19: an out-of-bounds write in the Fireware OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.[1,2]
• It affects the IKEv2 mobile user VPN and IKEv2 branch office VPNs configured with a dynamic gateway peer; a Firebox that once used those settings may stay vulnerable if a branch office VPN to a static gateway peer is still configured.[1,2]
• WatchGuard scored it 9.3 under CVSS v4.0; NVD scored it 9.8 under CVSS v3.1.[1,2]
• Fixed Fireware OS releases are 2025.1.4, 12.11.6, 12.5.15 (T15/T35) and 12.3.1 build 728352 (FIPS); WatchGuard also lists 11.10.2 through 11.12.4 as affected, and its solution names no 11.x release.[1]
• WatchGuard says threat actors are actively trying to exploit it, and post-exploit activity exfiltrated the active configuration file and, in one variant, the local management user database.[1]
• CISA added CVE-2025-14733 to KEV on 2025-12-19 with a 2025-12-26 due date and lists known ransomware campaign use.[3,4]
• Five weeks earlier, on 2025-11-12, CISA had added a separate Firebox iked out-of-bounds write, CVE-2025-9242, to the same catalog.[3]