Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Sophos Firewall 21.0 MR1 (21.0.1) Clear all filters
TI-2024-12979 CVE-2024-13973 · GHSA-jfx3-jv8f-g222

SQL injection in Sophos Firewall

Priority MEDIUM 48

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.12257 Published 2025-07-21 Fixed in 21.0 MR1 (21.0.1) CWE-89
TI-2024-12980 CVE-2024-13974 · GHSA-84xf-f99r-6prw

A business logic vulnerability in the Up2Date component of Sophos Firewall older than…

Priority MEDIUM 49

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.09069 Published 2025-07-21 Fixed in 21.0 MR1 (21.0.1) CWE-807