The resolved variations are 2025.1.4, 12.11.6, 12.5.15 (T15 & T35 fashions), and 12.3.1_Update4 (B728352) for the FIPS-certified launch. There isn’t any repair for 11.x, which is taken into account end of life.
Importantly, WatchGuard warned, patching will not be sufficient: “If the Firebox was beforehand configured with the cell person VPN with IKEv2 or a department workplace VPN utilizing IKEv2 to a dynamic gateway peer, and each of these configurations have since been deleted, that Firebox should be susceptible if a department workplace VPN to a static gateway peer remains to be configured.”
And a few admins have much more post-patching duties to carry out, it stated, noting, “along with putting in the newest Fireware OS that accommodates the repair, directors which have confirmed risk actor exercise on their Firebox home equipment should take precautions to rotate all domestically saved secrets and techniques on susceptible Firebox home equipment.”
Deja vu
In September, WatchGuard patched an analogous Firebox vulnerability, CVE-2025-9242, additionally affecting the iked VPN configuration and given a CVSS rating of 9.3. On the time, WatchGuard stated there have been no studies of lively exploitation, however by October, the corporate had revised this assessment after exploitation makes an attempt have been detected.
This can be a reminder to not learn preliminary vulnerability assessments for one of these infrastructure too optimistically — exploitation is often detected after a flaw has been made public. Firewalls and VPNs are main targets for cybercriminals, and each vital vulnerability in them represents a transparent and current cyber safety danger.
Sadly, the proof exhibits that some WatchGuard prospects don’t patch vulnerabilities as rapidly as they need to. In October, a scan by The Shadowserver Foundation discovered that over 71,000 Firebox home equipment had not but been patched for CVE-2025-9242, together with 23,000 within the US. Regardless of its zero-day standing, it’s more likely to be an analogous story for CVE-2025-14733.
