CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-25223

CVSS 9.8v3.1pub. 2020-09-25upd. 2025-11-07

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sophos Unified Threat Management

    APP
    Sophos
    9.5119.6079.705< 9.5119.600 – 9.607 (bez)9.700 – 9.705 (bez)

CISA KEV — detailsi

Vendori
Sophos
Producti
SG UTM
Added to KEVi
March 25, 2022
Remediation deadline (US Federal)i
April 15, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 15 kwietnia 2022
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2022-0386HIGH8.8ten sam produkt

A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to ex...

CVE-2014-2537HIGH7.8ten sam produkt

Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denia...

CVE-2021-25273MEDIUM4.8ten sam produkt

Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

CVE-2016-0777MEDIUM6.5ten sam produkt

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows r...

CVE-2012-3238MEDIUM4.3ten sam produkt

Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gatewa...