CVE-2025-7624

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-07-21

Last Modified2026-06-17

Data SourcesNVD

Vulnerability Description

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

Affected Platforms (CPE)

💻

Sophos

Firewall Firmware

< 21.0.2

References & Advisories

🔗 https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Related Vulnerabilities

CVE-2026-658937.0

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with ...

CVE-2026-645208.4

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies The ...

CVE-2026-645168.8

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCP...

CVE-2026-64511

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference Afte...