Sophos SG UTM Remote Code Execution Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-25223 · Published 25/09/2020 · updated 17/06/2026

Sophos SG UTM Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
unified threat management sophos	`= 9.511= 9.607= 9.705≥ 9.600, < 9.607≥ 9.700, < 9.705< 9.511`	`9.6079.7059.511`

Description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

References

packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html · Exploit
community.sophos.com/b/security-blog · Not Applicable
community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 · Vendor Advisory
cwe.mitre.org/data/definitions/78.html · Technical Description
secpod.com/blog/remote-code-execution-in-sophos-utm · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-25223

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free