Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-7624

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

Published

2025-07-21T14:15:30.413

Last Modified

2025-11-17T16:13:07.190

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-89
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System sophos firewall_firmware < 21.0.2 Yes
Hardware sophos firewall - No
References