PatchTheCVEfirewall firmware vulnerabilities and fixes
Recent CVEs affecting firewall firmware, with upgrade or downgrade steps. 8 tracked.
Also searched as: firewallfirmware.
firewall firmware has 8 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 8. Most recent: 2025-07-21. Highest priority: CVE-2025-7624 (score 66/100).
- CVE-2025-7624 CRITICAL 9.8 UPGRADE An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 2
- CVE-2025-7382 HIGH 8.8 UPGRADE A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lea
- CVE-2025-6704 CRITICAL 9.8 UPGRADE An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions o
- CVE-2024-13974 HIGH 8.1 UPGRADE A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1
- CVE-2024-13973 MEDIUM 6.8 UPGRADE A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) c
- CVE-2024-12729 HIGH 8.8 UPGRADE A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotel
- CVE-2024-12728 CRITICAL 9.8 UPGRADE A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older
- CVE-2024-12727 CRITICAL 9.8 UPGRADE A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than
FAQ
How do I fix firewall firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is firewall firmware being exploited right now?
None of the tracked firewall firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which firewall firmware CVE should I patch first?
CVE-2025-7624 currently ranks highest (66/100): An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 2.