CVE-2020-25223

sophos unified threat management

Published 25 Sept 2020 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

References

packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html · Exploit, Third Party Advisory, VDB Entry
community.sophos.com/b/security-blog · Not Applicable, Vendor Advisory
community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 · Vendor Advisory
cwe.mitre.org/data/definitions/78.html · Technical Description
www.secpod.com/blog/remote-code-execution-in-sophos-utm/ · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223 · US Government Resource