CVE-2024-13974

HIGH

Sophos Firewall < 21.0.1 - Remote Code Execution via Up2Date DNS Control

Title source: llm
STIX 2.1

Description

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

References (1)

Core 1

Scores

CVSS v3 8.1
EPSS 0.0654
EPSS Percentile 92.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-807
Status published
Products (1)
sophos/firewall_firmware < 21.0.1
Published Jul 21, 2025
Tracked Since Feb 18, 2026