CVE-2020-29574

sophos cyberoamos

Published 11 Dec 2020 · updated 15 Aug 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 6 Feb 2025, with a remediation deadline of 27 Feb 2025 for US federal agencies. It has been used in ransomware campaigns.

Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

References

www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/ · Third Party Advisory
www.cyberoam.com/ngfw.html · Product
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29574 · US Government Resource