CVE Feed

    Dashboard / CVE / CVE-2020-25223

    CVE-2020-25223

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

    Published:Sep 25, 2020
    Last Modified:Nov 7, 2025
    EPS:Sep 25, 2020
    EPSS Score:0.94415
    CVSS Score:9.8

    CISA Notification

    Description

    A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Apr 15, 2022
    1610 days ago
    Alert Date
    Mar 25, 2022
    1631 days ago

    Affected Products

    Vendor
    Sophos
    Product
    Unified Threat Management

    Exploits

    http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.htmlhttps://www.secpod.com/blog/remote-code-execution-in-sophos-utm/http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.htmlhttps://www.secpod.com/blog/remote-code-execution-in-sophos-utm/https://github.com/darrenmartyn/sophuckedhttps://github.com/maguireja/CVE-2020-25223

    Related CVEs

    CVE-2022-0652 (CVSS 3.3) — Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permi…
    CVE-2022-0386 (CVSS 8.8) — A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to ex…
    CVE-2021-25273 (CVSS 4.8) — Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.…
    CVE-2016-0777 (CVSS 6.5) — The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows r…
    CVE-2014-2537 (CVSS 7.8) — Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denia…
    CVE-2012-3238 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gatewa…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High