CVE-2020-25223Active Exploitation(sophos / unified_threat_management)

LOWCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for sophos unified_threat_management systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

sophos CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-04-15. Apply updates per vendor instructions.

Exploit / PoC references

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

unified_threat_management

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
1 total mentions across 1 day

Affected systems

Vendors

sophos

Products

unified_threat_management

3 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://viz.greynoise.io/tags/sophos-sg-utm-remote-code-execution-attempt?days=1

Full discourse1 post

Splash Brain R&D@splashbrain_172d
Active Exploitation
Notable uptick in CVE-2020-25223 exploitation over the last 60 days for Sophos users. Block attackers at firewall: https://viz.greynoise.io/tags/sophos-sg-utm-remote-code-execution-attempt?days=1 https://t.co/YC0mpl1Gty
Post summary
The post reports a noticeable rise in exploitation of CVE‑2020‑25223 against Sophos users over the past 60 days, highlighting real‑world attacks and urging firewall blocking.
000005
3 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sophos	unified_threat_management	-	-	-
App	sophos	unified_threat_management	9.511	-	-
App	sophos	unified_threat_management	9.607	-	-
App	sophos	unified_threat_management	9.705	-	-

Explore more

Back to dashboard sophos CVEs unified_threat_management vulnerabilities