A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before…
Priority CRITICAL 100Exploited in the wildCWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Why it matters now
Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.96753 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:* | before 9.511; 9.600 to before 9.607; 9.700 to before 9.705 | Vulnerable | Sophos |
| cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:* | 9.511 | Vulnerable | Sophos |
| cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:* | 9.607 | Vulnerable | Sophos |
| cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:* | 9.705 | Vulnerable | Sophos |
- cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:* Versions before 9.511; 9.600 to before 9.607; 9.700 to before 9.705 Vulnerable ·Sophos
- cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:* Versions 9.511 Vulnerable ·Sophos
- cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:* Versions 9.607 Vulnerable ·Sophos
- cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:* Versions 9.705 Vulnerable ·Sophos
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-03-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-25223
- 2026-10-03 Alias added: GHSA-pwxx-2hrw-72w5
References
Exploit 2
Advisory 2
More Sophos Unified Threat Management vulnerabilities
- TI-2022-00311 SQL injection in Sophos UTM CVSS 3.1HIGH 8.8
- TI-2014-02040 Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote… CVSS 2.0HIGH 7.8
- TI-2022-00568 Sensitive information in log files in Sophos UTM CVSS 3.1HIGH 7.8
- TI-2012-02788 Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in… CVSS 2.0MEDIUM 4.3
- TI-2021-07524 Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. CVSS 3.1MEDIUM 4.8
Sources
- CVE-2020-25223 · CVE Program
- CVE-2020-25223 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-pwxx-2hrw-72w5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences