🔴 CVE-2025-14733

Critical out-of-bounds write vulnerability in WatchGuard Fireware OS affecting IKEv2 VPN services. Remote unauthenticated attackers can execute arbitrary code on internet-facing firewall systems through direct network exploitation.

← Back to Overview
HIGH_RISK
Risk Level
9.3
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
VERY_HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-12-19

Added to CISA KEV: 2025-12-19 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2025-12-19)

Based on the search results, here's what is known about the CVE-2025-14733 vulnerability exploitation:

  • CISA Known Exploited Vulnerabilities (KEV) Status: CISA added CVE-2025-14733 to its KEV catalog, based on evidence of active exploitation [3][4]. CISA maintains the KEV catalog as an authoritative source of vulnerabilities exploited in the wild, recommending organizations use it to prioritize vulnerability management [2]. They require Federal Civilian Executive Branch (FCEB) agencies to remediate KEV vulnerabilities by a specified due date [5].
  • Active Exploitation: CISA added CVE-2025-14733 to the KEV catalog due to evidence of active exploitation [3][4].
  • Attack Vectors: The search results generally state that threat actors frequently use these types of vulnerabilities as attack vectors [1].
  • Impacted Products: While not explicitly stated in the search results, the vulnerability may affect internet-facing applications and services, given CISA's focus on vulnerabilities posing significant risks to the federal enterprise [1] and the inclusion of actively exploited vulnerabilities in their catalog [2].

Sources

  1. CISA Adds Three Known Exploited Vulnerabilities to Catalog

    These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of know…

  2. Known Exploited Vulnerabilities Catalog

    For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catal…

  3. CISA Adds Two Known Exploited Vulnerabilities to Catalog

    CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-14611…

  4. CISA Adds One Known Exploited Vulnerability to Catalog

    CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.Read more…

  5. CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

    BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all o…

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed