WatchGuard Technologies, Inc. holds two MA-L blocks — 00:01:21 and 00:90:7F — both registered to the same Seattle address (605 Fifth Ave. S, Seattle, WA 98104-3892). WatchGuard is an established network-security vendor: founded in 1996 as Seattle Software Labs, rebranded WatchGuard Technologies in 1997, taken private in 2006, and now majority-owned by Vector Capital (with Francisco Partners also holding a stake). Its hardware line is the Firebox family of Unified Threat Management (UTM) and Next-Generation Firewalls (NGFW) — the tabletop T Series for SMB and branch sites, the rackmount M Series for enterprise, plus virtual (FireboxV) and cloud (Firebox Cloud on AWS/Azure) form factors — alongside 802.11 Wi-Fi access points and multi-factor-authentication products. The analyst point is that a WatchGuard OUI on a network segment identifies a managed security appliance (a firewall, VPN gateway, or wireless controller), not a laptop or phone; it sits at the perimeter doing IPS, VPN, URL filtering, application control, and SD-WAN. That makes its presence worth a patch check: Firebox appliances have been a repeated exploitation target, with critical IKEv2 RCE chains (CVE-2025-9242 patched September 2025; CVE-2025-14733 actively exploited in December 2025) leaving tens of thousands of internet-facing units reportedly unpatched. A separate, unrelated IEEE entry — 00:1D:96 registered to "WatchGuard Video" of Plano, Texas (in-car police video) — must NOT be folded into this vendor record; it is a different company. IEEE publishes no assignment date for these blocks, so none is stated; the "09 November 2000" value seen on third-party tools is a database artifact, not an IEEE fact.
- IEEE assignment
- 2 prefixes → WatchGuard Technologies, Inc., registered Seattle, WA, US [Confirmed] — IEEE MA-L (file:enrichment/registries/oui.csv); corroborated https://hwaddress.com/company/watchguard-technologies-inc/
- Registry / block size
- MA-L (24-bit OUI); two blocks (00:01:21, 00:90:7F); none in MA-M or MA-S (mam.csv / oui36.csv) [Confirmed] — file:enrichment/registries/oui.csv. NOTE: IEEE's public OUI data publishes NO assignment/registration date (columns are only Registry, Assignment, Organization Name, Organization Address); the "09 November 2000" value on third-party tools (e.g., netify.ai) is a database artifact, not an IEEE fact.
- HQ / country
- 605 Fifth Ave. S, Seattle, WA 98104-3892, US (registry address) [Confirmed] — IEEE MA-L (file:enrichment/registries/oui.csv); https://en.wikipedia.org/wiki/WatchGuard
- Company status
- active; founded 1996 as Seattle Software Labs, rebranded WatchGuard Technologies in 1997; taken private in 2006; majority owner Vector Capital, with Francisco Partners also holding a stake [Confirmed] — https://en.wikipedia.org/wiki/WatchGuard
- Device types
- network-security appliances — Firebox UTM / NGFW (T Series tabletop SMB/branch; M Series rackmount enterprise; FireboxV virtual; Firebox Cloud on AWS/Azure), 802.11 Wi-Fi access points, and multi-factor-authentication products [Confirmed] — https://www.watchguard.com/wgrd-products/firewalls , https://en.wikipedia.org/wiki/WatchGuard
- Notable products
- Firebox T Series, Firebox M Series, FireboxV, Firebox Cloud [Confirmed] — https://www.watchguard.com/wgrd-products/firewalls
- Primary use context
- enterprise and SMB perimeter security — firewall, VPN gateway, IPS, antivirus, URL filtering, application control, SD-WAN, zero-trust access; deployed in small/branch offices, retail, enterprise data centres, and hybrid cloud [Confirmed] — https://www.watchguard.com/wgrd-products/firewalls , https://www.watchguard.com/wgrd-solutions/unified-threat-management
- Verified prefix sample (both MA-L)
- 00:01:21, 00:90:7F [Confirmed] — file:enrichment/registries/oui.csv ; https://maclookup.app/macaddress/00907F
- Special note
- A WatchGuard OUI identifies a managed security appliance (firewall / VPN gateway / wireless controller), NOT an end-user device. Do not fold in 00:1D:96 — that is a separate, unrelated company ("WatchGuard Video," Plano, TX, in-car police video). IEEE publishes no assignment date, so none is stated here. [Confirmed]
- Security context
- Firebox appliances are an active exploitation target (web angle, well-sourced). CVE-2025-9242 — critical IKEv2/iked RCE, patched September 2025, ~75,000 units reported internet-exposed. CVE-2025-14733 — related critical RCE (out-of-bounds write in the iked process), reported actively exploited December 2025 with 115,000+ unpatched devices found exposed. CVE-2024-6592 / CVE-2024-6593 — SSO Agent authentication-bypass issues. A WatchGuard MAC therefore warrants verification that firmware is current. [Likely] — single research angle (CVE IDs not cross-checked against NVD this cycle): https://www.bleepingcomputer.com/news/security/over-115-000-watchguard-firewalls-vulnerable-to-ongoing-rce-attacks/ , https://www.helpnetsecurity.com/2025/12/22/watchguard-firebox-vulnerability-cve-2025-14733/
- Related vendors
- network-security / firewall peers — Fortinet (FortiGate), SonicWall, Sophos, Palo Alto Networks (perimeter UTM/NGFW cross-reference)
- Analyst note
- A WatchGuard OUI in ARP/DHCP marks a security appliance at the network edge, not a workstation. Classify as infrastructure (firewall / VPN gateway / Wi-Fi controller) and treat its presence as a prompt to confirm the device is on current firmware, given the 2024–2025 Firebox RCE history.