Sophos
Sophos Firewall Firmware: vulnerabilidades y CVE
Sophos Firewall Firmware tiene 10 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE10
Últimos 12 meses0
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-7624 | Crítica (9.8) | 8.5% | — | 21 jul 2025 | An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was… |
| CVE-2025-7382 | Alta (8.8) | 4.8% | — | 21 jul 2025 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP… |
| CVE-2025-6704 | Crítica (9.8) | 9.5% | — | 21 jul 2025 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is… |
| CVE-2024-13974 | Alta (8.1) | 7.4% | — | 21 jul 2025 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution. |
| CVE-2024-13973 | Alta (7.2) | 10.0% | — | 21 jul 2025 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution. |
| CVE-2024-12729 | Alta (8.8) | 1.3% | — | 19 dic 2024 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). |
| CVE-2024-12728 | Crítica (9.8) | 0.94% | — | 19 dic 2024 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). |
| CVE-2024-12727 | Crítica (9.8) | 1.4% | — | 19 dic 2024 | A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific… |
| CVE-2021-25268 | Alta (8.4) | 0.91% | — | 5 may 2022 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. |
| CVE-2021-25267 | Alta (8.4) | 1.1% | — | 5 may 2022 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Sophos
Sophos Anti-virus · 36WEB Appliance · 18Anti-virus · 12XG Firewall Firmware · 9Sophos Puremessage Anti-virus · 9Unified Threat Management Software · 9Sophos Small Business Suite · 8Safeguard Easy Device Encryption Client · 8Sfos · 8Safeguard Enterprise Client · 7Safeguard LAN Crypt Client · 7Unified Threat Management · 6