CVE-2020-25223
Sophos SG UTM Remote Code Execution Vulnerability
Published Sep 24, 2020 · updated Jun 16, 2026 · sophos unified threat management
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Timeline
Detection, updates, and resolution for this record.
Sep 24, 2020 · Catalog
Detected
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe sophos/unified threat managementversion unspecified
- cpe sophos/unified threat management9.511
- cpe sophos/unified threat management9.607
- cpe sophos/unified threat management9.705
- vendor Sophos SG UTMversion unspecified
Sources
- CISA KEVCVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
cisa.gov - CVE.orgCVE-2020-25223
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-25223
30-day exploitation probability 96.8%
first.org - Metasploit Modulesexploit_linux/http/sophos_utm_webadmin_sid_cmd_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com