The firewall itself became the target
WatchGuard warned customers in December 2025 about CVE-2025-14733, a critical flaw in the IKEv2 VPN service used by Firebox appliances. The vulnerability was being actively exploited, so affected Firebox owners needed to install the vendor's fixed firmware without delay.
Update to the fixed Fireware release for the exact model.
Treating a configuration workaround as the final repair.
Check vendor indicators and rotate secrets if compromise is suspected.
Which systems were exposed
The flaw could allow an unauthenticated attacker to run code remotely on a vulnerable appliance. The risk depended on the Fireware version and VPN configuration, but removing one visible setting was not a reliable substitute for installing the vendor's fixed firmware.
What to do now
Identify every Firebox model and Fireware version, download the correct release from WatchGuard, save the configuration, install the update, and confirm the appliance returns on the fixed version. Review WatchGuard's indicators of compromise after patching.
Record model, Fireware version, VPN use, and public address.
Export the configuration and confirm recovery access.
Install the fixed vendor release and restart as required.
Confirm version, VPN service, logs, and indicators of compromise.
Good practice and mistakes to avoid
- Every internet-facing appliance reports a fixed version.
- The VPN works after the update.
- Indicators of compromise have been reviewed.
- Locally stored secrets are rotated when investigation requires it.
If the logs or indicators suggest compromise, isolate the device, preserve evidence, and rotate secrets stored on it. A firewall sits at the edge of the network, so leaving it exposed while planning a perfect maintenance window can create the larger outage.