‹ Retour à la liste

CVE-2020-25223

9.8 Critique Exploitée activement

Publiée le 25/09/2020 à 06:23 · Modifiée le 17/06/2026 à 05:06 · Analysée par le NVD · Source : cve@mitre.org

Catalogue CISA KEV — Sophos SG UTM Remote Code Execution Vulnerability

Ajoutée le 25/03/2022 · Échéance de correction (agences US) : 15/04/2022

Action requise : Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

Traduire en français

Produits concernés

Sophos unified threat management

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
2.0	10.0 Élevée	nvd@nist.gov (NVD)	`AV:N/AC:L/Au:N/C:C/I:C/A:C`

Faiblesses (CWE)

CWE-78

Références

http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
https://community.sophos.com/b/security-blog Not ApplicableVendor Advisory
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 Vendor Advisory
https://cwe.mitre.org/data/definitions/78.html Technical Description
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/ ExploitThird Party Advisory
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
https://community.sophos.com/b/security-blog Not ApplicableVendor Advisory
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223 Vendor Advisory
https://cwe.mitre.org/data/definitions/78.html Technical Description
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/ ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223 US Government Resource

Ailleurs