ZeroDay Findings
Sign inSign up

Findings

CVE-2020-29574

CyberoamOS (CROS) SQL Injection Vulnerability

Published Dec 11, 2020 · updated Aug 14, 2026 · sophos cyberoamos

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 11, 2020 · Catalog

    Detected

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

  2. Feb 6, 2025 · CISA KEV

    Known exploited

    The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

  3. Feb 27, 2025 · CISA KEV

    Remediation due

    The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

  4. Aug 14, 2026 · Catalog

    Updated

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Required action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

CISA due date Feb 27, 2025

Affected

  • cpe sophos/cyberoamosversion unspecified
  • vendor Sophos CyberoamOSversion unspecified

Sources

  • CISA KEVCVE-2020-29574

    CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

    cisa.gov
  • CVE.orgCVE-2020-29574

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-29574

    30-day exploitation probability 4.7%

    first.org
  • NIST NVDCVE-2020-29574

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

    nvd.nist.gov

References