CISA Listing Adds Ransomware Use for WatchGuard Firebox Flaw
SecurityUnverifiedUpdated:
CISA has reportedly updated its listing for WatchGuard Firebox flaw CVE-2025-14733 to include ransomware use. The flaw had been listed as actively exploited since December, and the update adds a more specific threat status.
Ransomware use added to an existing exploitation listing
BleepingComputer reported that CISA added CVE-2025-14733 to its actively exploited vulnerability catalog in December and has now identified it as being used by ransomware gangs. The flaw is a remote-code-execution (RCE) issue, meaning an unauthenticated attacker can run malicious code remotely, affecting specified WatchGuard Firebox devices running Fireware OS versions 11.x, 12.x, and 2025.1 through 2025.1.3.
CVE-2025-14733 had been listed as actively exploited since December, according to the report.
A reported CISA catalog update now identifies ransomware gangs as users of the vulnerability.
The reported update narrows the known exploitation status from active exploitation generally to documented ransomware use. The report says CISA did not provide further details about the attacks.
Sources
- BleepingComputerCISA: WatchGuard RCE flaw now exploited in ransomware attacksRead source →