CVE-2020-25223VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2020-25223: Sophos SG UTM Remote Code Execution Vulnerability

Affects Sophos SG UTMSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 96.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-25223 (opens in a new tab)

Description

CVE-2020-25223 is a high severity remote code execution vulnerability in the WebAdmin interface of Sophos SG UTM. It has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Summary

This vulnerability allows remote attackers to execute arbitrary code on the Sophos SG UTM device via its WebAdmin interface. It is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation has been observed in the wild, indicating active targeting. No detailed version or patch information is provided in the source data.

Impact

Successful exploitation enables remote code execution on the affected Sophos SG UTM device, potentially allowing attackers to take full control of the system. This can lead to compromise of network security and data confidentiality on the affected device.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor Sophos advisories for updates and apply any official fixes promptly once available.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:10:48 UTC

Weaknesses

References

Related threats