CVE-2025-6704

The flaw lies in the ability to write arbitrary files (arbitrary file writing) in the SPX module. The vulnerability is active only when the SPX feature is enabled and simultaneously the device operates in High Availability (HA) mode. The combination of these two configuration conditions creates an unauthenticated network-accessible attack vector, corresponding to CWE-78 (command injection) classification and potentially leading to execution of arbitrary system commands.

An attacker without any privileges can remotely execute arbitrary code on the firewall device, gaining full control over the system, including access to sensitive data, ability to modify configuration, and potential interception of network traffic protected by the device.

Sophos Firewall should be updated to version 21.0 MR2 (21.0.2) or newer. As a temporary workaround, if immediate update is not possible, consider disabling the SPX feature or High Availability (HA) mode until the patch is deployed. Details available in the official security advisory: https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Sophos Firewall in all versions prior to 21.0 MR2 (21.0.2), while simultaneously meeting both conditions: SPX feature enabled and High Availability (HA) mode active.