CVE-2024-13974

State: Published
Severity: 8.1 High
Published: Jul 21, 2025
Updated: Jul 21, 2025
Reserved: Jul 14, 2025

Description

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Sophos

Weaknesses

CWE-807 Reliance on Untrusted Inputs in a Security Decision

Affected Products

Product	Versions
Sophos FirewallSophos	before 21.0 MR1 (21.0.1)Affected

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.