FF
Product
Firewall Firmware
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 6Medium 0Low 0
Watch
Add Firewall Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-7624 | 9.8 | Jul 21 | An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining… Affected: before 21.0.2 |
| CVE-2025-6704 | 9.8 | Jul 21 | An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code… Affected: before 21.0.2 |
| CVE-2024-12728 | 9.8 | Dec 19 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3) Affected: before 20.0.3 |
| CVE-2024-12727 | 9.8 | Dec 19 | A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can… Affected: before 21.0.1 |
| CVE-2025-7382 | 8.8 | Jul 21 | A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High… Affected: before 21.0.2 |
| CVE-2024-12729 | 8.8 | Dec 19 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1) Affected: before 21.0.1 |
| CVE-2021-25268 | 8.4 | May 5 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA Affected: before 19.0 |
| CVE-2021-25267 | 8.4 | May 5 | Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA Affected: before 19.0 |
| CVE-2024-13974 | 8.1 | Jul 21 | A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to… Affected: before 21.0.1 |
| CVE-2024-13973 | 7.2 | Jul 21 | A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code… Affected: before 21.0.1 |
Showing 10