CVE-2024-13974

Published: Jul 21, 2025Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: security-alert@sophos.com (Secondary)

Description

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

Affected (1)

Products: Sophos: Firewall Firmware

Sophos

1 product

Firewall Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sophos Firewall Firmware	Before 21.0.1

Running on/with	Platform Versions
Sophos Firewall	All versions

Related CWEs

CWE-807

Reliance on Untrusted Inputs in a Security Decision

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

References (1)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Source: security-alert@sophos.com

Vendor Advisory

Timeline

No history available yet.