TI-2014-02040 Aliases CVE-2014-2537 GHSA-vvm2-f57h-2f5r

Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote…

MEDIUM 40CWE-399Published 2014-03-18 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.

Why it matters now

EPSS 0.03068 87th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:sophos:unified_threat_management_software::::::::	up to 9.108	Vulnerable	Sophos
cpe:2.3:a:sophos:unified_threat_management_software:8.3:::::::*	8.3	Vulnerable	Sophos
cpe:2.3:a:sophos:unified_threat_management_software:9.007:::::::*	9.007	Vulnerable	Sophos
cpe:2.3:a:sophos:unified_threat_management_software:9.107:::::::*	9.107	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:110:::::::*	110	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:120:::::::*	120	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:220:::::::*	220	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:320:::::::*	320	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:425:::::::*	425	Vulnerable	Sophos
cpe:2.3:h:sophos:unified_threat_management:525:::::::*	525	Vulnerable	Sophos

cpe:2.3:a:sophos:unified_threat_management_software:*:*:*:*:*:*:*:* Versions up to 9.108 Vulnerable ·Sophos
cpe:2.3:a:sophos:unified_threat_management_software:8.3:*:*:*:*:*:*:* Versions 8.3 Vulnerable ·Sophos
cpe:2.3:a:sophos:unified_threat_management_software:9.007:*:*:*:*:*:*:* Versions 9.007 Vulnerable ·Sophos
cpe:2.3:a:sophos:unified_threat_management_software:9.107:*:*:*:*:*:*:* Versions 9.107 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:110:*:*:*:*:*:*:* Versions 110 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:120:*:*:*:*:*:*:* Versions 120 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:220:*:*:*:*:*:*:* Versions 220 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:320:*:*:*:*:*:*:* Versions 320 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:425:*:*:*:*:*:*:* Versions 425 Vulnerable ·Sophos
cpe:2.3:h:sophos:unified_threat_management:525:*:*:*:*:*:*:* Versions 525 Vulnerable ·Sophos

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:h:sophos:unified_threat_management:625:::::::*	625	Vulnerable	Sophos

cpe:2.3:h:sophos:unified_threat_management:625:*:*:*:*:*:*:* Versions 625 Vulnerable ·Sophos

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2014-2537
2026-10-03 Alias added: GHSA-vvm2-f57h-2f5r

References

Patch 1

http://blogs.sophos.com/2014/02/20/utm-up2date-9-109/

TI-2020-15463 A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before… KEVCVSS 3.1CRITICAL 9.8
TI-2022-00311 SQL injection in Sophos UTM CVSS 3.1HIGH 8.8
TI-2022-00568 Sensitive information in log files in Sophos UTM CVSS 3.1HIGH 7.8
TI-2012-02788 Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in… CVSS 2.0MEDIUM 4.3
TI-2021-07524 Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences