Lucene search
+L

CVE-2024-13974

🗓️ 21 Jul 2025 13:34:11Reported by SophosType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 47 Views

Business logic vulnerability in Sophos Firewall allows DNS control and remote code execution for attackers.

Related
Detection
Affected
Refs
Social
NVD
Node
[
  {
    "defaultStatus": "unaffected",
    "product": "Sophos Firewall",
    "vendor": "Sophos",
    "versions": [
      {
        "lessThan": "21.0 MR1 (21.0.1)",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Action1corp

𝗧𝗼𝗱𝗮𝘆'𝘀 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 𝗼𝘃𝗲𝗿𝘃𝗶𝗲𝘄: Microsoft has addressed 107 vulnerabilities, one zero-day with PoC (CVE-2025-53779), 13 critical Third-party: actively exploited vulnerabilities in Google Chrome, Android, Apple, Cisco ISE, and Wing FTP Server, plus major third-party issues affecting Axis Communications, Dell ControlVault3, Nvidia, WordPress, and Sophos Firewall. Navigate to 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗗𝗶𝗴𝗲𝘀𝘁 𝗳𝗿𝗼𝗺 𝗔𝗰𝘁𝗶𝗼𝗻𝟭for comprehensive summary updated in real-time >>https://t.co/t0z4Y33kYz 𝗤𝘂𝗶𝗰𝗸 𝘀𝘂𝗺𝗺𝗮𝗿𝘆: 𝗪𝗶𝗻𝗱𝗼𝘄𝘀: 107 vulnerabilities, one zero-day with PoC (CVE-2025-53779), 13 critical 𝗚𝗼𝗼𝗴𝗹𝗲 𝗖𝗵𝗿𝗼𝗺𝗲: Actively exploited sandbox escape (CVE-2025-6558) 𝗔𝘅𝗶𝘀 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀: Multiple flaws; over 6,500 exposed servers 𝗗𝗲𝗹𝗹 𝗖𝗼𝗻𝘁𝗿𝗼𝗹𝗩𝗮𝘂𝗹𝘁𝟯: “ReVault” firmware vulnerabilities 𝗡𝘃𝗶𝗱𝗶𝗮 𝗧𝗿𝗶𝘁𝗼𝗻 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗦𝗲𝗿𝘃𝗲𝗿: Chained flaws; AI model theft and manipulation possible 𝗔𝗻𝗱𝗿𝗼𝗶𝗱: Two actively exploited Qualcomm GPU vulnerabilities (CVE-2025-21479, CVE-2025-27038) 𝗔𝗽𝗽𝗹𝗲 𝗶𝗢𝗦/𝗺𝗮𝗰𝗢𝗦: Actively exploited zero-day (CVE-2025-6558); 13 WebKit flaws and multiple OS component fixes across all platforms 𝗪𝗼𝗿𝗱𝗣𝗿𝗲𝘀𝘀 𝗣𝗼𝘀𝘁 𝗦𝗠𝗧𝗣 𝗣𝗹𝘂𝗴𝗶𝗻: Improper access control (CVE-2025-24000); 200,000+ sites vulnerable 𝗦𝗼𝗽𝗵𝗼𝘀 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹: Multiple RCEs (CVE-2025-6704, CVE-2025-7624, CVE-2025-7382) plus privilege escalation flaws (CVE-2024-13974, CVE-2024-13973) 𝗖𝗶𝘀𝗰𝗼 𝗜𝗦𝗘& 𝗜𝗦𝗘-𝗣𝗜𝗖: Critical unauthenticated RCE (CVE-2025-20337) plus previously disclosed CVE-2025-20281, CVE-2025-20282 now under active exploitation 𝗪𝗶𝗻𝗴 𝗙𝗧𝗣 𝗦𝗲𝗿𝘃𝗲𝗿: Actively exploited null byte injection (CVE-2025-47812); 5,000+ exposed web interfaces 𝗠𝗼𝗿𝗲 𝗱𝗲𝘁𝗮𝗶𝗹𝘀: https://t.co/FvbWKdjs9r 𝗦𝗼𝘂𝗿𝗰𝗲𝘀: - Action1 Vulnerability Digest>> https://t.co/FvbWKdjs9r - Microsoft Security Update Guide>>https://t.co/ShbdyyYumO #PatchTuesday #VulnerabilityManagement #ZeroDay #PatchManagement #Cybersecurity #InfoSec #EndpointSecurity #MicrosoftSecurity #SecurityUpdates #CVEs #ITOps #Action1

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 07:03Current
7.4High risk
Vulners AI Score7.4
CVSS 3.18.1
EPSS0.06705
SSVC
47