CVE-2020-29574

Description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-02-06
• Remediation due date: 2025-02-27
• Known ransomware campaign use: Known

Weakness types (CWE)

• CWE-89
• CWE-89

References

• https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/
• https://www.cyberoam.com/ngfw.html
• https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/
• https://www.cyberoam.com/ngfw.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29574

More from Sophos

• CVE-2020-15069 — XG Firewall
• CVE-2023-1671 — Web Appliance
• CVE-2022-3236 — Firewall
• CVE-2022-1040 — Firewall
• CVE-2020-25223 — SG UTM