CVE-2025-7624

The vulnerability (CWE-89) lies in the legacy transparent SMTP proxy component of Sophos Firewall. An attacker can inject malicious SQL queries through this component, which, combined with an active email quarantine policy and following a previous SFOS system update from a version older than 21.0 GA, leads to arbitrary code execution on the device. The network vector (AV:N) without authentication requirement (PR:N) means that the exploit can be performed remotely over the network.

Successful exploitation of this vulnerability allows an attacker to execute remote code (RCE) on a Sophos Firewall device, which may result in complete takeover of the device, breach of confidentiality, integrity and availability of protected resources.

Update Sophos Firewall to version 21.0 MR2 (21.0.2) or newer. Detailed instructions are available in the official security advisory from the vendor: https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Sophos Firewall versions older than 21.0 MR2 (21.0.2), provided both conditions are met simultaneously: active email quarantine policy AND the SFOS system was previously updated from a version older than 21.0 GA.