CVE-2025-7382

🗓️ 21 Jul 2025 13:28:38Reported by SophosType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 29 Views

Command injection in Sophos Firewall allows pre-auth code execution on High Availability auxiliary devices.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the WebAdmin interface of Sophos Firewall (formerly Sophos XG Firewall) allows a hacker to execute arbitrary code.	12 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-7382	22 Jul 202513:48	–	circl
CNNVD	Sophos Firewall 安全漏洞	21 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-7382	21 Jul 202513:28	–	cvelist
EUVD	EUVD-2025-22084	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7382	21 Jul 202514:15	–	nvd
OSV	CVE-2025-7382	21 Jul 202514:15	–	osv
Positive Technologies	PT-2025-30272 · Sophos · Sophos Firewall	21 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-7382	23 Jul 202514:31	–	redhatcve
The Hacker News	Sophos and SonicWall Patch Critical RCE Flaws Affecting Firewalls and SMA 100 Devices	24 Jul 202514:14	–	thn

NVD

Node

AND

sophos firewall_firmwareRange<21.0.2

sophos firewallMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Sophos Firewall",
    "vendor": "Sophos",
    "versions": [
      {
        "lessThan": "21.0 MR2 (21.0.2)",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
sophos	www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

17 Jun 2026 10:04Current

8High risk

Vulners AI Score8

CVSS 3.18.8

EPSS0.03795

SSVC

CWE-78