Multiple security vulnerabilities affecting Sophos firewall products, with two enabling pre-authentication remote code execution that could allow attackers to compromise systems without valid credentials. Users running supported versions including 19.0 MR2, 20.0 MR2/MR3, and 21.0 GA variants should verify hotfix application through Sophos support documentation to ensure comprehensive protection against these critical security flaws. The vulnerabilities, tracked as CVE-2025-6704, CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, and CVE-2024-13973, impact various configurations of Sophos Firewall versions 21.5 GA and older, with automatic hotfixes already deployed to address the most severe flaws. The CVE-2024-13974 vulnerability exploits business logic flaws in the Up2Date component, allowing attackers to control the firewall’s DNS environment and achieve remote code execution. Five serious flaws in Sophos Firewall, including pre-auth remote code execution, have been patched. This high-severity issue was discovered and disclosed by the UK’s National Cyber Security Centre (NCSC). The vulnerability demonstrates how legacy components can introduce significant security risks in modern network infrastructure. Security researchers discovered this flaw through Sophos’s bug bounty program and responsibly disclosed it to the company.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Jul 2025 13:10:08 +0000