CVE-2020-25223

CVE-2020-25223 is an unauthenticated OS command injection (CWE-78) in the WebAdmin management interface of Sophos SG UTM appliances. A remote attacker can trigger it by sending a crafted request to the WebAdmin service containing a malicious SID parameter, which is passed to the underlying system without proper sanitization. Successful exploitation yields remote code execution with high impact on confidentiality, integrity and availability (CVSS 3.1 score of 9.8), effectively giving the attacker control of the firewall appliance. Any organization running SG UTM versions prior to v9.705 MR5, v9.607 MR7, or v9.511 MR11 is affected, particularly where the WebAdmin interface is reachable from the internet. The flaw is being actively exploited: it was added to CISA KEV on 2022-03-25, carries a 96.7% EPSS exploitation probability, and public PoC material exists; any ransomware association is currently unknown.

What to do: Upgrade SG UTM to v9.705 MR5, v9.607 MR7, or v9.511 MR11 (or later) per vendor instructions, consistent with the CISA KEV required action. Until patched, restrict WebAdmin access to trusted management networks or VPN and ensure it is not directly exposed to the internet. Review WebAdmin access logs for anomalous or crafted SID parameter requests that may indicate prior exploitation, and note that ransomware-related use of this bug has not been confirmed.