Firewall Frenzy: WatchGuard's VPN Flaw Under Siege as Hackers Strike

It started with a subtle crash-a brief interruption in a company’s VPN connection. But behind the scenes, attackers were already inside, exploiting a flaw that could let them seize control of WatchGuard Firebox devices around the globe. As evidence of real-world attacks mounts, WatchGuard’s latest emergency advisory reveals a race against time to patch a critical vulnerability before more organizations fall victim.

The security world is no stranger to VPN vulnerabilities, but the latest bug in WatchGuard’s Fireware OS-CVE-2025-14733-is raising alarm due to active exploitation and its potential for devastating breaches. With a CVSS rating of 9.3, this out-of-bounds write flaw in the ‘iked’ process allows attackers to remotely execute arbitrary code, essentially handing over the keys to the network castle.

The attack surface is wider than many administrators might realize. Even devices where VPN configurations (specifically mobile user VPN with IKEv2 or branch office VPN using IKEv2 with dynamic peers) have been removed may still be at risk-so long as a branch office VPN to a static gateway peer remains active. This lingering vulnerability means that organizations relying on these configurations can't assume they're safe just because they've made recent changes.

WatchGuard has confirmed seeing attack attempts in the wild, with one notable IP address also implicated in recent high-profile attacks against Fortinet products. This suggests a pattern: threat actors are rapidly scanning for and exploiting VPN endpoints across multiple platforms, escalating the urgency for immediate action.

For defenders, WatchGuard has provided clear indicators of compromise (IoCs): abnormal log entries, unusually large certificate payloads, and the sudden crashing or hanging of the iked process. These breadcrumbs are critical for organizations to check if they’ve already been targeted.

While patches are now available for most supported versions of Fireware OS, legacy systems are left exposed due to end-of-life status. For those unable to patch immediately, WatchGuard recommends disabling dynamic peer VPNs, creating strict firewall aliases, and updating policies to restrict access-temporary measures that may buy precious time.

This vulnerability’s disclosure comes hot on the heels of another WatchGuard flaw added to CISA’s Known Exploited Vulnerabilities catalog just weeks ago, signaling an ongoing campaign against network infrastructure. Whether these attacks are linked remains unclear, but the message is unmistakable: VPNs are under siege, and complacency is no longer an option.

As attackers grow bolder and more sophisticated, the security of remote access tools like VPNs becomes a frontline battle. For organizations running WatchGuard Fireware OS, vigilance and swift patching are now matters of survival, not convenience. The war for the network perimeter is heating up-and this round, the hackers are moving fast.

WIKICROOK

• Out: Out-of-Band Verification confirms identity using a separate channel, like a phone call or text, to enhance security and prevent unauthorized access.
• IKEv2: IKEv2 is a protocol that securely sets up and manages VPN connections by exchanging encryption keys and authenticating devices over the internet.
• Indicators of Compromise (IoCs): Indicators of Compromise (IoCs) are clues like filenames, IPs, or code fragments that help detect if a computer system has been breached.
• CVSS: CVSS (Common Vulnerability Scoring System) is a standard method for rating the severity of security flaws, with scores from 0.0 to 10.0.
• Dynamic Gateway Peer: A dynamic gateway peer lets VPNs connect securely to remote devices with changing IP addresses, using alternative identification methods for authentication.