CISA Links WatchGuard Firebox Code-Execution Flaw to Ransomware Campaigns

CISA now says ransomware campaigns are exploiting CVE-2025-14733, a critical WatchGuard Firebox vulnerability that lets a remote unauthenticated attacker run code through the firewall’s IKEv2 service. CISA’s September 10 catalog record changes the known-ransomware field to Known and directs organizations to check every internet-accessible instance for signs of compromise after mitigation.

WatchGuard fixed the flaw in December 2025. The vendor’s advisory describes two post-exploit patterns: theft of the active Firebox configuration, and theft of both that configuration and the local management user database. A clean firmware version stops the vulnerable code path. It cannot show whether attackers copied secrets before the update.

CISA reports ransomware use

The CISA record confirms that the vulnerability is known exploited and known to be used in ransomware campaigns. It does not identify a ransomware family, operator, victim, attack date, or event count. The entry says formal forensic triage under BOD-26-04 is No, while its additional note still requires compromise checks on all internet-accessible instances after mitigation.

WatchGuard’s earlier disclosure establishes active attempts without tying its observed post-exploit activity to CISA’s ransomware finding. “WatchGuard has observed threat actors actively attempting to exploit this vulnerability in the wild,” the company writes. The two primary sources therefore support urgency and a concrete investigation path, but they do not establish that every observed Firebox compromise involved ransomware.

Neither source quantifies vulnerable internet-facing Fireboxes, successful compromises, victims, or ransomware events. Begin by checking each Firebox’s configuration and running version.

IKEv2 reaches the firewall process

CVE-2025-14733 is an out-of-bounds write in the Fireware OS iked process, which handles Internet Key Exchange negotiations. WatchGuard assigns a critical 9.3 CVSS v4 score and says exploitation may produce arbitrary code execution without authentication.

The exposed configurations are mobile-user VPN with IKEv2 and branch-office VPN using IKEv2 with a dynamic gateway peer. A configuration cleanup may leave a hidden edge case: a Firebox that previously used either vulnerable configuration can remain exposed after both are deleted when a branch-office VPN to a static gateway peer is still configured.

WatchGuard’s log indicators show the shape of observed attack traffic without disclosing a complete exploit packet. At the default error logging level, more than eight certificates in an IKEv2 authentication payload can produce Received peer certificate chain is longer than 8. Reject this certificate chain, which the vendor rates as a medium-confidence indicator. At the information logging level, an IKE_AUTH request with a CERT payload greater than 2000 bytes is a strong indicator.

Figure details

A remote unauthenticated request enters through an exposed IKEv2 VPN configuration and reaches the Fireware OS iked process. The out-of-bounds write may allow arbitrary code execution. WatchGuard then observed two post-exploit branches: encrypted exfiltration of the active configuration, or creation and exfiltration of a gzip archive containing the active configuration and local management user database. The defender path separates firmware remediation from incident recovery: install the fixed branch release, inspect the vulnerable interval for WatchGuard's network, log, and process indicators, and rotate locally stored secrets when threat-actor activity is confirmed.

Post-exploit activity steals secrets

In the first variant WatchGuard observed, the attacker encrypts the active configuration file and exfiltrates it to the same IP address that originated the attack. In the second, the attacker creates a gzip archive containing the active configuration and the local management user database, then sends that archive to the source address.

Those observations describe artifacts that were prepared and exfiltrated. WatchGuard does not say the ransomware operators identified by CISA performed those actions, nor does it report ransomware execution on a Firebox. Ransomware campaigns use the vulnerability; the vendor has separately observed configuration and credential-material theft after exploitation.

The recovery consequence follows from the stolen material. WatchGuard tells administrators with confirmed threat-actor activity to rotate every secret stored locally on the affected Firebox. Replacing firmware without that rotation leaves copied credentials and shared secrets usable elsewhere.

Check for exploitation indicators

WatchGuard directly associates six addresses with known threat-actor activity: 45[.]95[.]19[.]50, 51[.]15[.]17[.]89, 172[.]93[.]107[.]67, 199[.]247[.]7[.]82, 38[.]252[.]8[.]14, and 94[.]249[.]197[.]106. Outbound connections to one of them are a strong compromise indicator. Inbound connections can represent reconnaissance or an exploit attempt and require correlation with device logs and behavior.

The iked process supplies two more confidence levels. A hang during exploitation interrupts new VPN negotiations and rekeys while existing tunnels may continue passing traffic; WatchGuard rates that as strong evidence. A crash creates a Firebox fault report after a failed or successful attempt, but other faults can crash the same process, so the vendor rates a crash alone as weak evidence.

Search the vulnerable interval for the six addresses, the full certificate-chain message, oversized IKE_AUTH request entries, CERT sizes above 2000 bytes, and iked hangs or crashes. Preserve configuration, fault reports, VPN logs, and network-flow records before rebuilding or rotating credentials.

Patch, inspect, and rotate

Match each Firebox to the vendor’s branch-specific floor. The advisory lists these first fixed releases:

Fireware OS branch	Affected range	First fixed release
Default 2025	>= 2025.1, < 2025.1.4	2025.1.4
Default 12	>= 12.0, < 12.11.6	12.11.6
Default 11	>= 11.10.2, <= 11.12.4+541730	newer than 11.12.4+541730
T15/T35	>= 12.0, < 12.5.15	12.5.15
FIPS	>= 12.0, < 12.3.1+728352	12.3.1-b728352

Patch the deployed branch to its fixed release. If an immediate update is impossible and the Firebox uses only branch-office VPN tunnels to static gateway peers, WatchGuard offers a temporary hardening procedure; it does not replace the firmware update.

After installation, check that the running Fireware OS version meets the applicable floor. Then review every internet-accessible instance across its vulnerable interval for the six addresses and the graded log or process indicators. Any confirmed threat-actor activity triggers rotation of all locally stored Firebox secrets and investigation of systems that trusted them.

A Firebox passes remediation when its running version is outside the affected range. Recovery requires a second result: the retained evidence accounts for the vulnerable interval, and every potentially copied secret has been replaced where activity was confirmed. Firmware state protects the next negotiation; incident evidence determines what the previous one exposed.