Known vulnerabilities in Sophos Firewall

Vendor: Sophos
Software CPE: cpe:2.3:h:sophos:xg_firewall:*:*:*:*:*:*:*:*
Total vulnerabilities: 29
Public exploits: 4
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Sophos Firewall Sophos Firewall is affected by 29 known vulnerabilities: 8 critical, 6 high, 6 medium, 9 low Critical High Medium Low

Vulnerabilities (29)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU113100 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-13973
CWE-89 Medium
No
No
21.0 MR1 22.07.2025 SB2025072202
#VU113099 - Business Logic Errors (3.0)
CVE-2024-13974
CWE-840 High
No
No
21.0 MR1 22.07.2025 SB2025072202
#VU113098 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-7382
CWE-78 Critical
No
No
21.0 MR2 22.07.2025 SB2025072202
#VU113097 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-7624
CWE-89 Critical
No
No
21.0 MR2 22.07.2025 SB2025072202
#VU113095 - Unrestricted Upload of File with Dangerous Type
CVE-2025-6704
CWE-434 High
No
No
21.0 MR2 21.07.2025 SB2025072202
#VU101874 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-12729
CWE-78 High
No
No
21.0.1 20.12.2024 SB2024122002
#VU101873 - Use of Weak Credentials
CVE-2024-12728
CWE-1391 Critical
No
No
20.0.3, 21.0.1 20.12.2024 SB2024122002
#VU101872 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-12727
CWE-89 Critical
No
No
21.0.1 20.12.2024 SB2024122002
#VU82288 - Exposure of sensitive information to an unauthorized actor
CVE-2023-5552
CWE-200 Low
No
No
19.5.4, 20.0.0 20.10.2023 SB2023102041
#VU70115 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-3226
CWE-78 Medium
No
No
19.5.0 12.12.2022 SB2022121209
#VU70114 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-3709
CWE-79 Low
No
No
19.5.0 12.12.2022 SB2022121209
#VU70113 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-3713
CWE-94 High
No
No
19.5.0 12.12.2022 SB2022121209
#VU70112 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-3710
CWE-89 Low
No
No
19.5.0 12.12.2022 SB2022121209
#VU70111 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-3711
CWE-89 Low
No
No
19.5.0 12.12.2022 SB2022121209
#VU70110 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-3696
CWE-94 Low
No
No
19.5.0 12.12.2022 SB2022121209
#VU67805 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-25267
CWE-79 Medium
No
No
18.5.4 03.10.2022 SB2022100315
#VU67804 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-25268
CWE-79 Medium
No
No
18.5.4 03.10.2022 SB2022100315
#VU67802 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-1807
CWE-89 Medium
No
No
18.5.4, 19.0.1 03.10.2022 SB2022100315
#VU67624 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-3236
CWE-94 Critical
No
Exploited
17.0.10, 18.5.5, 19.0.2, 19.5.0 24.09.2022 SB2022092401
#VU62765 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-1292
CWE-78 Medium
Available
No
18.5.4, 19.0.1 03.05.2022 SB2022050315
SB2022050436
SB2022050503
and 141 more


Showing elements 1 - 20 out of 29