CVE-2025-6704

CRITICAL

Sophos Firewall Firmware < 21.0.2 - OS Command Injection

Title source: rule

Description

An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.

Scores

CVSS v3 9.8
EPSS 0.0044
EPSS Percentile 63.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-78
Status published

Affected Products (1)

sophos/firewall_firmware < 21.0.2

Timeline

Published Jul 21, 2025
Tracked Since Feb 18, 2026