CVE-2020-25223

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

96.75% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-03-25

Nuclei

critical · CWE-78

Published

2020-09-25

Updated

2025-10-21

Proof-of-concept exploits (4)

• http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html
• darrenmartyn/sophucked11★ · 2021-09-13
• maguireja/CVE-2020-252233★ · 2021-09-11
• twentybel0w/CVE-2020-252233★ · 2021-09-11

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25223.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sophos_utm_webadmin_s…

Security advisories

• https://community.sophos.com/b/security-blog
• https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadm…
• https://www.secpod.com/blog/remote-code-execution-in-sophos-utm

References

• CVE Record
• NVD entry

Related

• CVE-2020-7373
• CVE-2020-8515
• CVE-2020-9054
• CVE-2021-25162