CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-09-25
Sophos SG UTM WebAdmin Remote Code Execution (RCE) Vulnerability Advisory (CVE-2020-25223)
[Affected Scope] Sophos SG UTM versions prior to v9.705 MR5, v9.607 MR7, and v9.511 MR11 with WebAdmin enabled
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending specially crafted HTTP requests
[Mitigation] Immediately upgrade to patched firmware versions (v9.705 MR5, v9.607 MR7, v9.511 MR11 or later) and restrict external access to WebAdmin (TCP 4444)