Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-7624 EUVD-2025-22085GHSA-rjpf-qp74-8rgx

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to …

Published Jul 21, 2025 · Updated Jul 21, 2025 · Assigned by Sophos

Vendor: Sophos Product: Sophos Firewall Category: Network devices

Description

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

Affected products

VendorProductAffectedFixed
Sophos Sophos Firewall < 21.0 MR2 (21.0.2) 21.0 MR2 (21.0.2)

Advisories 1

References