HIGH🇵🇱 Wersja polska

CVE-2024-13974

CVSS 8.1v3.1pub. 2025-07-21upd. 2025-11-17

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sophos Firewall

    HW
    Sophos
    all versions

  • Sophos Firewall Firmware

    OS
    Sophos
    < 21.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEFirewall
CWE
References

Related vulnerabilities

CVE-2022-3236CRITICAL9.8⚠ KEVPL ✓same product

Code injection w Sophos Firewall — RCE przez User Portal i Webadmin

CVE-2025-6704CRITICAL9.8PL ✓same product

Sophos Firewall SPX – pre-auth RCE przez zapis dowolnych plików

CVE-2025-7624CRITICAL9.8PL ✓same product

SQL Injection w Sophos Firewall SMTP Proxy prowadzące do RCE

CVE-2024-12728CRITICAL9.8PL ✓same product

Słabe dane uwierzytelniające SSH w Sophos Firewall – nieautoryzowany dostęp uprzywilejowany

CVE-2024-12727CRITICAL9.8PL ✓same product

Pre-auth SQL injection w Sophos Firewall umożliwiający RCE