CVE-2024-13973

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...

CVE-2024-13973

CVE-2024-13973 : A post-auth SQL injection vulnerability in the WebAdmin component of Sophos Firewall, affecting versions older than 21.0 MR1 (21.0.1). Exploitation could allow an administrator to achieve arbitrary code execution. The root cause is a SQL injection in WebAdmin; no exploit details ...

CVE-2024-13973

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...

CVE-2024-13974

CVE-2024-13974 : A business-logic vulnerability in the Sophos Firewall Up2Date component (versions older than 21.0 MR1 / 20.0.1) can enable an attacker to take control of the firewall’s DNS environment and achieve remote code execution. Affected product: Sophos Firewall. Root cause: business logi...

CVE-2024-13974

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 20.0.1 can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution...

CVE-2024-13974

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 20.0.1 can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution...

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...

CVE-2025-7382

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...

CVE-2025-7382

Summary (CVE-2025-7382) : A command-injection vulnerability exists in the WebAdmin component of Sophos Firewall versions older than 21.0 MR2 (21.0.2). If OTP authentication for the admin user is enabled, adjacent attackers can achieve pre-auth code execution on High Availability (HA) auxiliary de...

CVE-2025-7624

CVE-2025-7624 is a SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall, fixed in 21.0 MR2 (21.0.2) and older versions may allow remote code execution if a quarantining policy is active and SFOS was upgraded from a version older than 21.0 GA. The affected software...

CVE-2025-7624

An SQL injection vulnerability in the legacy transparent SMTP proxy of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA...

CVE-2025-7624

An SQL injection vulnerability in the legacy transparent SMTP proxy of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA...

CVE-2025-6704

An arbitrary file writing vulnerability in the Secure PDF eXchange SPX feature of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability HA mode...

CVE-2025-6704

CVE-2025-6704 is an arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall . The pre-auth remote code execution condition requires a specific SPX configuration enabled in combination with the firewall running in High Availability (HA) mode. Multiple sourc...

CVE-2025-6704

An arbitrary file writing vulnerability in the Secure PDF eXchange SPX feature of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability HA mode...

PT-2025-30270

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR1 20.0.1 Description A business logic vulnerability exists in the Up2Date component of Sophos Firewall. This vulnerability could allow attackers to control the firewall’s DNS environment, potentially...

PT-2025-30273

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description An SQL injection vulnerability exists in the legacy transparent SMTP proxy. Successful exploitation can lead to remote code execution if a quarantining policy is active for Email an...

PT-2025-30269

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description A post-authentication SQL injection vulnerability exists in the WebAdmin component. Successful exploitation can potentially allow administrators to achieve arbitrary code execution...

CVE-2025-6704: Improper Neutralization of Special Elements used in an OS Command

An arbitrary file writing vulnerability in the Secure PDF eXchange SPX feature of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability HA mode...

Sophos Firewall security vulnerabilities

Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0.2, which stems from a SQL injection issue in the SMTP proxy that could lead to remote code execution...