Vulnerability Details : CVE-2020-25223
Public exploit exists!
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Vulnerability category: Execute code
Products affected by CVE-2020-25223
- cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*
- cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*
- cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*
- cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:*
- cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:*
- cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:*
CVE-2020-25223 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Sophos SG UTM Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2020-25223
Added on
2022-03-25
Action due date
2022-04-15
Exploit prediction scoring system (EPSS) score for CVE-2020-25223
94.42%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2020-25223
-
Sophos UTM WebAdmin SID Command Injection
Disclosure Date: 2020-09-18First seen: 2022-12-23exploit/linux/http/sophos_utm_webadmin_sid_cmd_injectionThis module exploits an SID-based command injection in Sophos UTM's WebAdmin interface to execute shell commands as the root user. Authors: - Justin Kennedy - wvu <wvu@metasploit.com>
CVSS scores for CVE-2020-25223
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-03 |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2020-25223
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2020-25223
-
https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223
Advisory: Resolved RCE in SG UTM WebAdmin (CVE-2020-25223) - Community Security Blog - Sophos Community - Sophos CommunityVendor Advisory
-
https://cwe.mitre.org/data/definitions/78.html
CWE - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (4.0)Technical Description
-
http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html
Sophos UTM WebAdmin SID Command Injection ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/
CVE-2020-25223: Remote Code Execution Flaw in SophosExploit;Third Party Advisory
-
https://community.sophos.com/b/security-blog
Sophos CommunityNot Applicable;Vendor Advisory
Jump to