machevalia/CVE-2025-14733

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based network scanner that sends IKEv2 IKE_SA_INIT requests to detect WatchGuard Firebox appliances and identify versions potentially vulnerable to CVE-2025-14733. It parses vendor ID payloads to extract version and build numbers, then compares them against known affected ranges. The tool does not exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python IKEv2 scanner and a README. The scanner sends standard IKE_SA_INIT probes, parses responses for WatchGuard vendor IDs and version strings, and compares versions against the CVE-2025-14733 advisory ranges. No backdoor, concealed payload, persistence, credential theft, or unrelated remote access behavior is present. The code performs only the documented scanning and version-checking operations.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWatchGuard Fireware OS
Attack typesscanner
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner. It sends IKEv2 probes to detect WatchGuard devices and checks version strings against known affected ranges without attempting to trigger the out-of-bounds write vulnerability. The README explicitly states 'This tool performs safe version detection through standard IKEv2 negotiation. It does not attempt exploitation.' The code contains no exploit payloads, memory corruption triggers, or shellcode.

README.md:5CVE-2025-14733-Scanner.py:1-493

Requirements

  • Target must expose IKEv2 service on UDP port 500CVE-2025-14733-Scanner.py:306
  • Target must respond to IKE_SA_INIT with a valid IKEv2 response containing vendor ID payloadsCVE-2025-14733-Scanner.py:115-224

Observed behavior

  • Sends a crafted IKE_SA_INIT request packet to the target on UDP port 500CVE-2025-14733-Scanner.py:328-329
  • Parses the IKEv2 response to extract vendor ID strings and identifies WatchGuard devices by looking for 'WatchGuard' or 'Firebox' substrings or base64-encoded version stringsCVE-2025-14733-Scanner.py:163-219
  • Compares the extracted version against known affected ranges (11.10.2-11.12.4_Update1, 12.0-12.11.5, 2025.1-2025.1.3) to determine if the target is potentially vulnerableCVE-2025-14733-Scanner.py:254-302
  • Outputs scan results to console and optionally to a JSON file, labeling hosts as VULNERABLE, NOT_VULNERABLE, or UNKNOWN_VERSIONCVE-2025-14733-Scanner.py:465-489
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Probe
UDP/500 IKE_SA_INIT packet with standard IKEv2 payloads (SA, KE, Nonce)The scanner sends a single IKE_SA_INIT request per target to elicit a version-disclosing response; this is the expected behavior for a detection tool.CVE-2025-14733-Scanner.py:67-112CVE-2025-14733-Scanner.py:306-329
Version Parsing
Extracts VN= and BN= from Vendor ID payloads, including base64-encoded WatchGuard version stringsThe tool parses IKEv2 Vendor ID payloads to identify WatchGuard devices and extract Fireware OS version and build numbers for vulnerability comparison.CVE-2025-14733-Scanner.py:163-219
Vulnerability Check
Compares parsed version against CVE-2025-14733 affected ranges (11.10.2-11.12.4_Update1, 12.0-12.11.5, 2025.1-2025.1.3)The check_vulnerable_version function implements the exact version ranges from the WatchGuard advisory without any exploitation attempt.CVE-2025-14733-Scanner.py:254-302
Review boundaries

What the analysis did not establish

  • Analysis based solely on static source code review; code was not executed.
  • Only the two text files (scanner script and README) were provided; no binary or network capture evidence was included.
  • Only the two text files (CVE-2025-14733-Scanner.py and README.md) were provided; no other files exist in the repository snapshot.
  • Binary content is absent from the evidence; the analysis is limited to the supplied readable text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1