CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
WatchGuard Fireware OS iked Process Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2025-14733) Urgent Security Advisory
[Affected Scope] WatchGuard Firebox appliances running Fireware OS configured with IKEv2 mobile user VPN or branch office VPN using a dynamic gateway peer, or where these configurations were previously deleted but a static gateway peer VPN remains.
[Impact] A critical vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to trigger an out-of-bounds write (CWE-787) in the iked process via crafted IKEv2 packets, leading to arbitrary code execution (RCE) with root privileges.
[Mitigation] Since this vulnerability is actively exploited and listed in the CISA KEV catalog, immediately upgrade to the patched Fireware OS version and restrict or disable IKEv2 services where possible.
WatchGuard Fireware OS IKEv2 Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2025-9242)
[Affected Scope] WatchGuard Firebox appliances running Fireware OS with IKEv2 Mobile User VPN or Branch Office VPN (BOVPN) configured with a dynamic gateway peer (including legacy configurations where static peers remain active)
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending specially crafted IKEv2 packets, leading to complete compromise of the appliance
[Mitigation] Immediately upgrade to the patched Fireware OS version, or temporarily disable IKEv2 VPN services and restrict access to trusted IP addresses
Cisco IOS and IOS XE IKEv2 Packet Processing Remote Denial of Service and Memory Leak Vulnerability (CVE-2018-0158)
[Affected Scope] Cisco devices running Cisco IOS or Cisco IOS XE Software with the IKEv2 protocol enabled.
[Impact] An unauthenticated, remote attacker can trigger a continuous memory leak by sending crafted IKEv2 packets, eventually causing a device reload and a complete Denial of Service (DoS) condition.
[Mitigation] Apply the official Cisco software updates or restrict access to IKEv2 ports (UDP 500/4500) using Infrastructure Access Control Lists (iACLs).
Cisco IOS and IOS XE IKEv2 Protocol Processing Remote Denial of Service Vulnerability (CVE-2017-12237)
[Affected Scope] Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3.5 through 16.5 with ISAKMP enabled
[Impact] Unauthenticated, remote attackers can trigger high CPU utilization, traceback messages, or device reloads (DoS) by sending crafted IKEv2 packets
[Mitigation] Apply official Cisco software patches immediately, or restrict UDP 500/4500 traffic at the network boundary using Infrastructure ACLs (iACLs).