CVE-2020-25223: Sophos SG UTM Remote Code Execution Vulnerability

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADE

CVE-2020-25223 is a critical-severity flaw (CVSS 9.8) affecting unified threat management, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	96.8% (top 1%)
CISA exploited list	Yes, fix due 2022-04-15
Weakness	CWE-78
Published	2020-09-25
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: sophos

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-09-25 04:23 UTCPublished CVE record published
2022-03-25Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-04-15Deadline CISA due date for US federal agencies to patch
2026-06-17 03:06 UTCUpdated Record last modified

sophos unified threat management UPGRADE

Affected: < 9.511 · >= 9.600 and < 9.607 · >= 9.700 and < 9.705 · 9.511 · 9.607 · 9.705

Fixed in: 9.511, 9.607, 9.705

Safe to downgrade to: a release before 9.511

1. Check installed version

apt-cache policy unified-threat-management || rpm -q unified-threat-management || unified-threat-management --version

2. UPGRADE to 9.511 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade unified-threat-management

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade unified-threat-management

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 9.511 (Debian / Ubuntu)

apt-cache madison unified-threat-management sudo apt install unified-threat-management=<VERSION_BEFORE_9.511> sudo apt-mark hold unified-threat-management

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list unified-threat-management sudo dnf downgrade unified-threat-management-<VERSION_BEFORE_9.511> sudo dnf versionlock add unified-threat-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · feh · FIXED · 3.13.1-1.fc46 · FEDORA-2026-3c76a13a4f · source

sudo dnf upgrade --advisory=FEDORA-2026-3c76a13a4f

Fedora ELN · setroubleshoot · FIXED · 3.3.37-7.eln159 · FEDORA-2026-f81b122fe1 · source

sudo dnf upgrade --advisory=FEDORA-2026-f81b122fe1

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: darrenmartyn/sophucked (11 stars)
GitHub PoC: maguireja/CVE-2020-25223 (3 stars)
Write-up: community.sophos.com/b/security-blog
Write-up: community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-20
Write-up: www.secpod.com/blog/remote-code-execution-in-sophos-utm/
GitHub PoC: Live-Hack-CVE/CVE-2020-25223
Metasploit: Sophos UTM WebAdmin SID Command Injection
Nuclei scan template: Sophos UTM Preauth - Remote Code Execution

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-25223?

unified threat management: upgrade to 9.511, 9.607, 9.705. Exact commands for each OS are on this page.

Is CVE-2020-25223 being exploited?

Yes. CVE-2020-25223 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2020-25223 affect?

CVE-2020-25223 affects unified threat management. Severity is critical (CVSS 9.8). A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11

How urgent is CVE-2020-25223?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Sophos vulnerabilities

Related CVEs

CVE-2023-22897 MEDIUM 6.5 UPGRADE An issue was discovered in SecurePoint UTM before 12.2.5.1
CVE-2023-22620 HIGH 7.5 UPGRADE An issue was discovered in SecurePoint UTM before 12.2.5.1
CVE-2022-0652 LOW 3.3 UPGRADE Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permi
CVE-2022-0386 HIGH 8.8 UPGRADE A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to ex
CVE-2021-25273 MEDIUM 4.8 UPGRADE Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

References

← Back to latest CVEs