CVE-2024-13974

8.1 highEPSS 9.1%

High (8.1) in sophos firewall firmware. EPSS 9.1% chance of exploitation in the next 30 days.

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 9.1% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-807
Published: 2025-07-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sophos:firewall_firmware

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Check your stack JSON