The Cybersecurity and Infrastructure Security Agency (CISA) on Sept. 9 confirmed that an out-of-bounds write bug in WatchGuard Firebox that CISA added to the Known Exploited Vulnerabilities (KEV) catalog in December was now being used in ransomware campaigns.While security pros said the timeframe from disclosure to added to the KEV and then exploited by ransomware was fairly normal, they made it clear that teams should not wait almost a year to patch a bug that’s been added to the KEV."Security leaders must treat a KEV listing for an unauthenticated, internet-facing firewall RCE as the ransomware warning itself," said Collin Hogue-Spears, senior director of solution management at Black Duck.“Apply the federal one-week remediation lock to every internet-facing appliance CVE that enters the catalog, whatever the ransomware field says, because CISA publishes no alert when that field changes,” said Hogue-Spears. “If we wait for the ransomware flag before we prioritize an edge-appliance CVE, we will read about our own intrusion in the catalog nine months after it started.”Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, also confirmed that the nine-month KEV-to-ransomware escalation is normal, but that doesn't means teams should wait around. Krell said CISA added CVE-2025-14733 to the KEV catalog in December 2025 with the ransomware field set to "Unknown," then silently flipped it to "Known" this week.“In 2025, CISA quietly updated that flag on 59 vulnerabilities, with gaps ranging from one day to over 1,300 days, and no announcement when any of them changed,” said Krell. “The gap reflects CISA's confirmation timeline. Ransomware operators were almost certainly exploiting this within days of disclosure.”Krell said teams running WatchGuard Firebox appliances should patch to Fireware 12.11.6, 2025.1.4, or 12.5.15: rotate every credential on the appliance even if team has already patched, since WatchGuard confirmed attackers were exfiltrating configs and management databases. Krell added that teams should also watch the bigger pattern: WatchGuard shipped an almost identical pre-auth remote code execution, CVE-2025-9242, three months before this one from December.“Same bug class, same product,” said Krell. “I'd plan for a third.”Adrian Culley, offensive security engineer at SafeBreach, added that’s what’s notable here isn't that ransomware gangs are now in this flaw — what's notable is that it’s the second near-identical out-of-bounds write in Firebox in three months.
Culley said CVE-2025-14733 mirrors CVE-2025-9242's characteristics closely enough that WatchGuard's patch cadence looks less like remediation and more like “whack-a-mole” against a class of bug in the same code path.
Culley explained that the mechanism is unauthenticated, low-complexity, and reachable pre-auth wherever IKEv2 VPN or a branch-office tunnel to a static gateway was configured — exactly the always-on, internet-facing service a firewall exists to expose.“That's [standard] T1190, external-facing exploitation, straight into whatever lateral movement the ransomware crew brings next,” said Culley. “Patch availability was never the gap. Nine months on, Shadowserver still counts several thousand exposed devices, down from over 115,000 in December — real progress, but not zero, on a device class that sits directly on the network boundary.”
Culley’s advice: patch, then specifically verify IKEv2 and branch-office VPN configurations are the ones the team thinks they are. And, validate that whatever detects post-compromise lateral movement has actually been tested against this device class, not assumed.
Culley said CVE-2025-14733 mirrors CVE-2025-9242's characteristics closely enough that WatchGuard's patch cadence looks less like remediation and more like “whack-a-mole” against a class of bug in the same code path.
Culley explained that the mechanism is unauthenticated, low-complexity, and reachable pre-auth wherever IKEv2 VPN or a branch-office tunnel to a static gateway was configured — exactly the always-on, internet-facing service a firewall exists to expose.“That's [standard] T1190, external-facing exploitation, straight into whatever lateral movement the ransomware crew brings next,” said Culley. “Patch availability was never the gap. Nine months on, Shadowserver still counts several thousand exposed devices, down from over 115,000 in December — real progress, but not zero, on a device class that sits directly on the network boundary.”
Culley’s advice: patch, then specifically verify IKEv2 and branch-office VPN configurations are the ones the team thinks they are. And, validate that whatever detects post-compromise lateral movement has actually been tested against this device class, not assumed.
