CVE-2025-14733 - Possible Unauthenticated RCE Exploit Attempt Against WatchGuard Firebox IKEv2/ISAKMP VPN Service (port 500)

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.