Sophos Sophos Firewall
21 CVEs affecting Sophos Sophos Firewall. Latest disclosed: 2025-07-21. Critical: 6, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7624 | Critical | 9.8 | 2025-07-21 | An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executio… |
CVE-2025-6704 | Critical | 9.8 | 2025-07-21 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth… |
CVE-2024-12728 | Critical | 9.8 | 2024-12-19 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). |
CVE-2024-12727 | Critical | 9.8 | 2024-12-19 | A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting… |
CVE-2022-3236 | Critical | 9.8 | 2022-09-23 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. |
CVE-2022-1040 | Critical | 9.8 | 2022-03-25 | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. |
CVE-2025-7382 | High | 8.8 | 2025-07-21 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code e… |
CVE-2024-12729 | High | 8.8 | 2024-12-19 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1… |
CVE-2022-3713 | High | 8.8 | 2022-12-01 | A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. |
CVE-2021-25268 | High | 8.4 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. |
CVE-2024-13974 | High | 8.1 | 2025-07-21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’… |
CVE-2022-3696 | High | 7.2 | 2022-12-01 | A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3226 | High | 7.2 | 2022-12-01 | An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-1807 | High | 7.2 | 2022-09-07 | Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 1… |
CVE-2023-5552 | High | 7.1 | 2023-10-17 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version… |
CVE-2024-13973 | Medium | 6.8 | 2025-07-21 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving a… |
CVE-2022-3709 | Medium | 6.8 | 2022-12-01 | A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version… |
CVE-2021-25267 | Medium | 6.8 | 2022-05-05 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. |
CVE-2022-0331 | Medium | 5.3 | 2022-03-29 | An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5… |
CVE-2022-3711 | Medium | 4.3 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall rele… |