Sophos Sophos Firewall
productEUA product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
2critical9high2medium1low
updated 2026-10-30
01
vulnerabilities (21)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2022-1040US | critical9.8OT critical | KEV | ||||
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. | ||||||
| CVE-2022-3236US | critical9.8OT critical | KEV | ||||
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. | ||||||
| CVE-2024-13973US | high7.2 | — | ||||
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code executi… | ||||||
| CVE-2025-6704US | — | — | ||||
An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution… | ||||||
| CVE-2025-7624US | — | — | ||||
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining… | ||||||
| CVE-2024-13974US | — | — | ||||
A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to… | ||||||
| CVE-2025-7382US | — | — | ||||
A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Avai… | ||||||
| CVE-2022-3226US | high7.2 | — | ||||
An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. | ||||||
| CVE-2022-0331US | medium5.3 | — | ||||
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older. | ||||||
| CVE-2024-12727US | — | — | ||||
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead… | ||||||
| CVE-2024-12729US | — | — | ||||
A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). | ||||||
| CVE-2022-3696US | high7.2 | — | ||||
A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. | ||||||
| CVE-2022-1807US | high7.2 | — | ||||
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. | ||||||
| CVE-2021-25267US | high8.4 | — | ||||
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. | ||||||
| CVE-2024-12728US | — | — | ||||
A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). | ||||||
| CVE-2021-25268US | high8.4 | — | ||||
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. | ||||||
| CVE-2022-3709US | high8.4 | — | ||||
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA. | ||||||
| CVE-2022-3711US | medium4.3 | — | ||||
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than versi… | ||||||
| CVE-2022-3710US | low2.7 | — | ||||
A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older t… | ||||||
| CVE-2022-3713US | high8.8 | — | ||||
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. | ||||||
| CVE-2023-5552US | high7.5 | — | ||||
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) an… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-89Improper Neutralization of Special Elements used in an SQL Command6 CVEs
- CWE-94Improper Control of Generation of Code4 CVEs
- CWE-78Improper Neutralization of Special Elements used in an OS Command3 CVEs
- CWE-79Improper Neutralization of Input During Web Page Generation3 CVEs
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
- CWE-1391Use of Weak Credentials1 CVEs
- CWE-287Improper Authentication1 CVEs
- CWE-522Insufficiently Protected Credentials1 CVEs
03
sources (1)
Which sources assert this record, and when.
- EUEU Vulnerability Database (ENISA)21 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan