CVE-2020-25223

A critical remote code execution vulnerability exists in the WebAdmin interface of specific versions of Sophos Unified Threat Management (UTM) appliances. This flaw arises from improper validation of user input, allowing an attacker to execute arbitrary code on the affected system. The vulnerability is particularly concerning due to its high CVSS score of 9.8, indicating a severe risk level. Attackers can exploit this weakness by sending crafted requests to the WebAdmin interface, which may lead to unauthorized access and control over the device. The affected versions include those prior to v9.705 MR5, v9.607 MR7, and v9.511 MR11, making it imperative for organizations using these systems to assess their current software versions.

The primary attack vector for this vulnerability is remote access to the WebAdmin interface, which is typically exposed to the internet or internal networks. An attacker could leverage this exposure to send specially crafted HTTP requests that exploit the input validation flaw. Once the attacker successfully executes code, they can manipulate the device to perform actions such as altering configurations, exfiltrating sensitive data, or launching further attacks within the network. Exploitation scenarios could range from a targeted attack on a specific organization to broader campaigns aimed at compromising multiple devices across various sectors.

The real-world impact of this vulnerability is significant, particularly for organizations relying on Sophos UTM for network security. Successful exploitation could lead to unauthorized access to sensitive information, disruption of services, and potential compliance violations, especially in regulated industries. The financial implications of such breaches can be substantial, including costs associated with incident response, remediation, and potential legal liabilities. Furthermore, the reputational damage incurred from a security breach can erode customer trust and lead to long-term business consequences.

To detect and mitigate this vulnerability, organizations should prioritize updating their Sophos UTM appliances to the latest versions that address the flaw. Regular vulnerability assessments and penetration testing can help identify potential weaknesses in the network. Additionally, implementing network segmentation and restricting access to the WebAdmin interface can reduce the attack surface. Employing intrusion detection and prevention systems (IDPS) can also aid in monitoring for suspicious activity related to the exploitation of this vulnerability. Organizations should maintain a robust patch management policy to ensure timely updates and protect against known vulnerabilities.

In conclusion, the remote code execution vulnerability in the WebAdmin interface of specific Sophos UTM versions poses a serious threat to organizations that utilize these devices for network security. The potential for exploitation underscores the importance of proactive security measures, including regular updates, access controls, and continuous monitoring. By understanding the nature of this vulnerability and implementing effective detection and mitigation strategies, organizations can significantly reduce their risk exposure and safeguard their critical assets against malicious actors.

Since the initial disclosure, CSURFACE threat intelligence has identified a significant evolution in the exploitation landscape surrounding CVE-2020-25223. Notably, new proof-of-concept exploit code has surfaced publicly on GitHub, accompanied by the release of a Metasploit module that automates exploitation of the Sophos UTM WebAdmin vulnerability. This development substantially lowers the technical barrier for attackers, enabling a broader range of threat actors to attempt remote code execution against affected systems. Our telemetry indicates a marked escalation in exploit attempts following these releases, reflecting increased adversary interest and operational activity. The vulnerability’s addition to the CISA Known Exploited Vulnerabilities catalog further elevates its priority for defenders, signaling recognition at the federal level of its active exploitation risk. Correspondingly, the CVSS score has been formally assigned as critical (9.8), and the EPSS score has surged to a high level, underscoring the probability of successful exploitation in the wild. Collectively, these changes amplify the threat level posed by CVE-2020-25223, emphasizing an urgent need for heightened vigilance in detection and response efforts across environments utilizing vulnerable Sophos UTM versions.

Update 2 — July 29, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2020-25223, reflected by a significant uptick in detection activity across our telemetry. This surge indicates increased adversary interest and operational use of available exploits, including those leveraging the Metasploit module and publicly accessible proof-of-concept code. Although the EPSS score remains stable at a high level, the sharp rise in observed activity underscores an elevated risk of compromise for environments running vulnerable Sophos SG UTM versions. This development heightens the urgency for defenders to prioritize monitoring and incident response capabilities, as the expanding exploitation footprint suggests adversaries are actively capitalizing on this critical remote code execution vulnerability.

Update 3 — August 17, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2020-25223, with our telemetry indicating a significant uptick in adversary activity against vulnerable Sophos SG UTM instances. This surge coincides with sustained interest in publicly available proof-of-concept exploits and the Metasploit module, facilitating broader operational use by threat actors. Although the EPSS score remains stable, the increased detection frequency signals a growing exploitation footprint that elevates the risk of successful remote code execution attacks. For defenders, this intensification underscores an urgent need to enhance visibility into WebAdmin interface traffic and to prioritize detection strategies tailored to this vulnerability. The evolving threat landscape suggests adversaries are increasingly leveraging this critical flaw, potentially expanding their foothold within targeted networks.