ByteOS Network

Vulnerability Details :

CVE-2020-25223

Summary

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-25 Sep, 2020 | 00:00

Updated At-30 Jul, 2025 | 01:45

Sophos SG UTM Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Known Exploited Vulnerabilities (KEV)

cisa.gov

Vendor:

Sophos Ltd.

Product:SG UTM

Added At:25 Mar, 2022

Due At:15 Apr, 2022

Sophos SG UTM Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.

Used in Ransomware

Unknown

CWE

CWE-78

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-25223

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:25 Sep, 2020 | 00:00

Updated At:30 Jul, 2025 | 01:45

▼CVE Numbering Authority (CNA)

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://cwe.mitre.org/data/definitions/78.html	N/A
https://community.sophos.com/b/security-blog	N/A
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223	N/A
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html	N/A
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/	N/A

Hyperlink: https://cwe.mitre.org/data/definitions/78.html

Resource: N/A

Hyperlink: https://community.sophos.com/b/security-blog

Resource: N/A

Hyperlink: https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html

Resource: N/A

Hyperlink: https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://cwe.mitre.org/data/definitions/78.html	x_transferred
https://community.sophos.com/b/security-blog	x_transferred
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223	x_transferred
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html	x_transferred
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/	x_transferred

Hyperlink: https://cwe.mitre.org/data/definitions/78.html

Resource:

x_transferred

Hyperlink: https://community.sophos.com/b/security-blog

Resource:

x_transferred

Hyperlink: https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html

Resource:

x_transferred

Hyperlink: https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-78	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Type: CWE

CWE ID: CWE-78

Description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-03-25

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223

Timeline

Event	Date
CVE-2020-25223 added to CISA KEV	2022-03-25 00:00:00

Event: CVE-2020-25223 added to CISA KEV

Date: 2022-03-25 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:25 Sep, 2020 | 04:23

Updated At:03 Apr, 2025 | 20:07

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-03-25	2022-04-15	Sophos SG UTM Remote Code Execution Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-03-25

Due Date: 2022-04-15

Vulnerability Name: Sophos SG UTM Remote Code Execution Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Sophos Ltd.

>>unified_threat_management>>Versions before 9.511(exclusive)

cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*

Sophos Ltd.

>>unified_threat_management>>Versions from 9.600(inclusive) to 9.607(exclusive)

cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*

Sophos Ltd.

>>unified_threat_management>>Versions from 9.700(inclusive) to 9.705(exclusive)

cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*

Sophos Ltd.

>>unified_threat_management>>9.511

cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:*

Sophos Ltd.

>>unified_threat_management>>9.607

cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:*

Sophos Ltd.

>>unified_threat_management>>9.705

cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-78	Primary	nvd@nist.gov
CWE-78	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-78

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-78

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html	cve@mitre.org	Exploit Third Party Advisory VDB Entry
https://community.sophos.com/b/security-blog	cve@mitre.org	Not Applicable Vendor Advisory
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223	cve@mitre.org	Vendor Advisory
https://cwe.mitre.org/data/definitions/78.html	cve@mitre.org	Technical Description
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/	cve@mitre.org	Exploit Third Party Advisory
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://community.sophos.com/b/security-blog	af854a3a-2127-422b-91ae-364da2661108	Not Applicable Vendor Advisory
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://cwe.mitre.org/data/definitions/78.html	af854a3a-2127-422b-91ae-364da2661108	Technical Description
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory

Hyperlink: http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://community.sophos.com/b/security-blog

Source: cve@mitre.org

Resource:

Not Applicable

Vendor Advisory

Hyperlink: https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://cwe.mitre.org/data/definitions/78.html

Source: cve@mitre.org

Resource:

Technical Description

Hyperlink: https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

Hyperlink: http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html