Ransomware Crews Now Hitting Unpatched WatchGuard Firewalls, CISA Warns

Key points

• Ransomware gangs are exploiting CVE-2025-14733, a critical flaw in WatchGuard Firebox firewalls, according to a CISA update on Thursday.
• The bug lets attackers run their own code on the firewall over the internet, with no login required.
• WatchGuard released patches in December 2024, but Shadowserver still counts nearly 9,000 unpatched devices exposed online.
• The flaw affects Fireware OS 11.x, 12.x and 2025.1 through 2025.1.3, in configurations that use the IKEv2 VPN feature.
• WatchGuard serves more than 250,000 small and mid-sized businesses through 17,000 resellers worldwide.

Ransomware gangs are breaking into unpatched WatchGuard firewalls to plant file-locking malware on the networks behind them.

CISA, the federal body that tracks active cyber threats, added that detail on Thursday to its running list of bugs known to be under attack. The flaw is CVE-2025-14733, a serious weakness in WatchGuard's Firebox line of firewalls (the boxes that sit at the edge of a company network and decide what traffic is allowed in and out). CISA didn't name the ransomware crews involved or say how many victims there are.

What exactly is the bug?

It's an out-of-bounds write flaw, meaning the firewall's software can be tricked into writing data where it should not, and an attacker anywhere on the internet can use that mistake to run their own commands on the device. No credentials needed. WatchGuard's own advisory rates the attack as low complexity: easy to pull off once you know how.

The hole exists in firewalls set up to use IKEv2 VPN, a common way of building encrypted tunnels for remote staff and branch offices. WatchGuard has warned that customers who removed the vulnerable VPN settings can still be at risk if a branch-office VPN pointing to a fixed partner address remains active.

Which devices need patching?

Any Firebox firewall running an affected version of Fireware OS, WatchGuard's firewall operating system. Fixes shipped in December 2024, and WatchGuard published indicators that defenders can use to check whether their box has already been compromised.

Nine months on, nearly 9,000 are still sitting there unfixed.

Why does this matter beyond IT teams?

WatchGuard sells mainly to small and mid-sized businesses: dentists, law firms, local manufacturers, regional retailers. When a firewall is taken over, attackers hold the front door of the whole company network. From there, ransomware crews typically steal data and lock file servers, the kind of incident that closes a small business for days or weeks.

If you get a letter in the coming weeks saying your dentist or accountant suffered a cyberattack, this bug is one plausible cause. Watch for unexpected password-reset emails and phishing that name-checks the business, both are common follow-ups.

Has this happened before with WatchGuard?

Yes, and the pattern's wearing thin. As reported by BleepingComputer, WatchGuard patched an almost identical remote code execution flaw, CVE-2025-9242, in September 2025. CISA flagged it as actively exploited a month later, when Shadowserver still saw more than 75,000 vulnerable Fireboxes online. In 2022, another Firebox bug, CVE-2022-23176, was used by a Russian state-linked botnet before agencies were ordered to patch it. We covered this vendor's persistent patching problems on 1 September in "WatchGuard Patches Five Critical Flaws That Could Let Attackers Seize Control Remotely".

Fix ships. Most people ignore it. Criminals catch up. That's the whole story, repeated.