Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Sophos Firewall 21.0 MR2 (21.0.2) Clear all filters
TI-2025-06724 CVE-2025-7382 · GHSA-848r-3x2j-g9jr

OS command injection in Sophos Firewall

Priority MEDIUM 48

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.04857 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-78
TI-2025-06959 CVE-2025-7624 · GHSA-rjpf-qp74-8rgx

SQL injection in Sophos Firewall

Priority MEDIUM 62

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10514 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-89
TI-2025-06088 CVE-2025-6704 · GHSA-5m7h-7mwc-924h

OS command injection in Sophos Firewall

Priority MEDIUM 62

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11772 Published 2025-07-21 Fixed in 21.0 MR2 (21.0.2) CWE-78