Sophos fixes Firewall vulnerabilities that enable unauthenticated remote code execution
Take action: If you are using Sophos Firewall, check the advisory in detail for the specific configurations that are vulnerable. If you have such a config, patch ASAP. Otherwise, plan a regular patch cycle.
Learn More
Sophos has patched multiple security vulnerabilities in Sophos Firewall that could enable attackers to achieve remote code execution and compromise network infrastructure. The issues require specific configuration to be exploited, which per Sophos estimates covers less than 5% of total install base.
Vulnerabilities summary
- CVE-2025-6704 (CVSS score 9.8) - arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature that can lead to pre-authentication remote code execution if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.
- CVE-2025-7624 (CVSS score 9.8) - SQL injection vulnerability in the legacy transparent SMTP proxy. The flaw can lead to remote code execution if a quarantining policy is active for email and SFOS was upgraded from a version older than 21.0 GA.
- CVE-2025-7382 (CVSS score 8.8) - command injection vulnerability in WebAdmin. This flaw can lead to adjacent attackers achieving pre-authentication code execution on High Availability (HA) auxiliary devices if OTP authentication for the admin user is enabled.
- CVE-2024-13974 (CVSS score 8.1) - business logic vulnerability in the Up2Date component. The flaw can lead to attackers controlling the firewall's DNS environment to achieve remote code execution.
- CVE-2024-13973 (CVSS score 6.8) - post-authentication SQL injection vulnerability in WebAdmin that can potentially lead to administrators achieving arbitrary code execution.
Affected versions:
- CVE-2024-13974 and CVE-2024-13973 affect Sophos Firewall v21.0 GA (21.0.0) and older versions,
- CVE-2025-6704, CVE-2025-7624, and CVE-2025-7382 impact Sophos Firewall v21.5 GA (21.5.0) and older versions.
Patched versions
- CVE-2025-6704 hotfixes were published on June 24, 2025, for versions 19.0 MR2, 20.0 MR2, 20.0 MR3, 21.0 GA, 21.0 MR1-2, and 21.5 GA, with additional hotfixes on July 1, 2025, for 21.0 MR1 and 21.0 MR1-1. The fixes were first included in version 21.0 MR2 and newer releases.
- CVE-2025-7624 hotfixes were published on July 15, 2025, for all supported versions including 19.0 MR2, 20.0 MR2, 20.0 MR3, 21.0 GA, 21.0 MR1, 21.0 MR1-1, 21.0 MR1-2, and 21.5 GA. Organizations using automatic hotfix installation received these critical patches without manual intervention.
Organizations should update their Sophos firewalls and verify that hotfixes have been properly applied to their firewall deployments.
