How severe is CVE-2020-25223?

CVE-2020-25223 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-25223 being actively exploited?

Yes. CVE-2020-25223 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2020-25223?

CVE-2020-25223 primarily affects Sophos Unified Threat Management. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-25223?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2020-25223 have an EU (EUVD) identifier?

Yes. CVE-2020-25223 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-17913. It is also flagged as exploited in the EUVD (since 2022-03-25).

When was CVE-2020-25223 published?

CVE-2020-25223 was published on 2020-09-25 and last updated on 2026-06-17.

CVE-2020-25223

CVE-2020-25223 is a critical-severity vulnerability in Sophos Unified Threat Management with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-03-25). The underlying weakness is classified as CWE-78.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 97% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2022-03-25)
EU (EUVD) id: EUVD-2020-17913
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-03-25)
Weakness: CWE-78
Affected product: Sophos Unified Threat Management
Published: 2020-09-25
Last modified: 2026-06-17

Description

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

Frequently asked questions

What is CVE-2020-25223?: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
How severe is CVE-2020-25223?: CVE-2020-25223 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-25223 being actively exploited?: Yes. CVE-2020-25223 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-03-25, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2020-25223?: CVE-2020-25223 primarily affects Sophos Unified Threat Management. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-25223?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2020-25223 have an EU (EUVD) identifier?: Yes. CVE-2020-25223 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-17913. It is also flagged as exploited in the EUVD (since 2022-03-25).
When was CVE-2020-25223 published?: CVE-2020-25223 was published on 2020-09-25 and last updated on 2026-06-17.

References

Affected products (4)

cpe:2.3:a:sophos:unified_threat_management:*:*:*:*:*:*:*:*
cpe:2.3:a:sophos:unified_threat_management:9.511:-:*:*:*:*:*:*
cpe:2.3:a:sophos:unified_threat_management:9.607:-:*:*:*:*:*:*
cpe:2.3:a:sophos:unified_threat_management:9.705:-:*:*:*:*:*:*

More vulnerabilities in Sophos Unified Threat Management

CVE-2022-0386 — High (CVSS 8.8): A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute…
CVE-2014-2537 — High (CVSS 7.8): Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of…
CVE-2021-25273 — Medium (CVSS 4.8): Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVE-2012-3238 — Medium (CVSS 4.3): Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before…
CVE-2022-0652 — Low (CVSS 3.3): Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions.…

All CVEs affecting Sophos Unified Threat Management →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-56004 — Critical (CVSS 10.0): A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by…
CVE-2026-56415 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is…
CVE-2026-56413 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens…
CVE-2026-49869 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in…
CVE-2026-49261 — Critical (CVSS 10.0): MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through…
CVE-2026-10520 — Critical (CVSS 10.0): An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a…

Browse all CWE-78 (OS Command Injection) vulnerabilities →