Ransomware gangs exploit critical vulnerability in WatchGuard firewalls: 9,000 devices still at risk

CISA Confirms: Ransomware Exploits Critical WatchGuard Firebox Vulnerability

The CISA has identified active exploitation of the vulnerability CVE-2025-14733, an out-of-bounds write that allows remote code execution in low-complexity attacks. The bug affects Firebox firewalls with Fireware OS 11.x (including 11.12.4_Update1), 12.x (including 12.11.5), and 2025.1-2025.1.3.

Quick Response

Technical Details and At-Risk Configurations

WatchGuard specified that unpatched devices are only vulnerable if configured for IKEv2 VPN, but the risk persists even after removing these configurations if there is a VPN for remote offices to a static peer gateway. The security patch was released in December, but many devices remain exposed.

Over 115,000 Devices Exposed, 9,000 Still Vulnerable

Shadowserver detected over 115,000 unpatched WatchGuard firewalls online in December, with nearly 9,000 still exposed after nine months. This number represents a significant risk for organizations using these configurations.

CISA Updates Catalog of Exploited Vulnerabilities

In its latest update to the catalog of actively exploited vulnerabilities, CISA confirmed that CVE-2025-14733 is now used by ransomware gangs, although it did not provide further details on the attacks. The vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog in December, with the order to federal agencies to patch within a week.

Similar Precedents and History of WatchGuard Vulnerabilities

Two years ago, CISA had ordered government agencies to patch another actively exploited WatchGuard vulnerability, CVE-2022-23176, which affected Firebox and XTM firewalls. More recently, in September 2025, WatchGuard patched a vulnerability almost identical to CVE-2025-14733, but Shadowserver still found over 75,000 firewalls exposed to this new threat.

Impact on Small and Medium Enterprises

WatchGuard provides services to over 250,000 small and medium enterprises through a network of more than 17,000 resellers and security service providers worldwide. This significantly amplifies the potential impact of the vulnerability, making it critical to patch exposed devices.

Security Considerations and Ransomware Protection

The discovery of this actively exploited vulnerability underscores the importance of robust cyber insurance and effective incident response for organizations. Protecting sensitive data through enterprise DLP solutions becomes even more crucial in this context.

The Importance of Managed SOC and MDR Services

To mitigate the risks associated with this vulnerability, organizations should consider implementing a managed SOC or adopting an MDR service. These services can continuously monitor networks and respond quickly to attacks, reducing the potential impact of actively exploited vulnerabilities.

NIS2 Compliance and DORA Regulation

Organizations must also consider the impact of this vulnerability on NIS2 compliance and the DORA regulation. Failure to patch critical vulnerabilities can lead to significant security breaches, with severe legal and financial consequences.

Continuous Monitoring and Security Updates

Proactive vulnerability management is essential to prevent ransomware attacks. Organizations should implement Security Information and Event Management (SIEM) tools to monitor suspicious activities and respond quickly to threats. Additionally, it is crucial to keep all security devices updated and apply security patches as soon as they are available.

The CISA's confirmation that the vulnerability CVE-2025-14733 is actively exploited by ransomware gangs underscores the urgent need to patch exposed devices. Organizations must take proactive measures to protect their networks and ensure compliance with current regulations. Implementing advanced security solutions and continuous vulnerability management are fundamental to preventing ransomware attacks and protecting sensitive data.

Frequently Asked Questions

Security Solutions Market and Economic Impact

The persistence of over 9,000 vulnerable devices has a significant impact on the cyber insurance market, with an expected increase in cyber insurance premiums for organizations that have not yet patched their systems. According to recent analyses, requests for breach remediation have increased by 35% in the last six months, with average costs per incident exceeding €2.5 million for SMEs.

Market Trends and Adoption of New Technologies

The adoption of advanced solutions such as Zero Trust Architecture and Identity Access Management (IAM) is strongly growing, with a 40% increase in corporate implementations in 2025. These technologies offer an additional layer of protection against attacks that exploit vulnerabilities like CVE-2025-14733, reducing the risk of remote code execution.

Impact on Disaster Recovery Strategies

Organizations are reviewing their disaster recovery as a service (DRaaS) and business continuity strategies to include specific measures against ransomware attacks. The ability to quickly restore compromised systems has become a priority, with an average 20% increase in investment in enterprise backup and ransomware recovery solutions.

Compliance and Security Audits

The need to comply with the NIS2 directive and the DORA regulation is pushing organizations to invest in security audits and ISO 27001 certification. These processes include periodic vulnerability assessments and the implementation of corrective measures, with a particular focus on network devices such as WatchGuard firewalls.

Challenges for Security Service Providers

Security service providers, including managed Security Operations Centers (SOC as a Service) and MDR services, are facing significant challenges in managing the vast range of unpatched devices. The increased demand for penetration testing and vulnerability assessments has led to a 25% increase in the costs of these services, with delivery times extending up to 6 months.

Future Perspectives and Forecasts

Experts predict that the number of vulnerable devices will continue to decrease, but will not disappear completely. By the end of 2026, it is estimated that over 70% of organizations will have implemented advanced cloud security posture and CSPM solutions, significantly reducing the risk of ransomware attacks. However, the complexity of modern IT infrastructures will require continuous monitoring and regular updates.

Conclusion and Long-Term Strategies

The current situation underscores the importance of a proactive approach to cybersecurity. Organizations must invest in advanced technologies, train personnel, and adopt vulnerability management practices to protect their sensitive data. Collaboration between security service providers, government agencies, and companies is essential to address future challenges and ensure a safer digital environment.