Security Affairs
Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback|Australian Police Charge Two Over TeamPCP Credential Theft|Meta to Pay Up to $18B Over Teen Social Media Use|CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do|OpenAI banned Russian ChatGPT accounts backing covert influence operation|CISA Red Team Fully Compromised Two Critical Infrastructure Orgs|FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure|U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog|88 ID Verification Breaches Show the Cost of Collecting Identity Data|WhatsApp Adds Stronger Security as Passkeys Hit 1 Billion|Operation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global Scams|Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack|
Advertisement

Ad Placeholder

Full Width × 90

Breaking News

Sophos fixed two critical Sophos Firewall vulnerabilities

Sophos addressed five Sophos Firewall vulnerabilities that could allow remote attackers to execute arbitrary code. Sophos has fixed five vulnerabilities (CVE-2025-6704, CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, CVE-2024-13973) in Sophos Firewall that could allow an attacker to remotely execute arbitrary code. “Sophos has resolved five independent security vulnerabilities in Sophos Firewall. Every Critical and High severity vulnerability was […]

Sophos Firewall

Sophos addressed five Sophos Firewall vulnerabilities that could allow remote attackers to execute arbitrary code.

Sophos has fixed five vulnerabilities (CVE-2025-6704, CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, CVE-2024-13973) in Sophos Firewall that could allow an attacker to remotely execute arbitrary code.

“Sophos has resolved five independent security vulnerabilities in Sophos Firewall. Every Critical and High severity vulnerability was remediated through hotfixes.” reads the advisory. “No action is required for Sophos Firewall customers to receive these fixes with the “Allow automatic installation of hotfixes” feature enabled on remediated versions (see Remediation section below). Enabled is the default setting.”

The critical flaw CVE-2025-6704 (CVSS score of 9.8) in Sophos Firewall’s SPX feature can lead to pre-auth remote code execution if combined with HA mode. The issue affects ~0.05% of devices and was responsibly disclosed via Sophos’ bug bounty program.

The flaw CVE-2025-7624 (CVSS score of 9.8) is an SQL injection in Sophos Firewall’s legacy SMTP proxy that may allow remote code execution if email quarantining is active and the system was upgraded from pre-21.0 GA versions. It affects up to 0.73% of devices and was responsibly disclosed via Sophos’ bug bounty program.

The remaining flaws addressed by the cybersecurity firm are two high-severity vulnerabilities, respectively tracked as CVE-2025-7382 and CVE-2024-13974, and a medium-severity issue tracked as CVE-2024-13973.

CVE-2025-7382 (CVSS score of 8.8) is a command injection in WebAdmin that may allow adjacent attackers to execute code pre-auth on HA auxiliary devices if OTP is enabled. Affects ~1% of devices.

CVE-2024-13974 (CVSS score of 8.1) is a business logic flaw in the Up2Date component that could let attackers control DNS settings and achieve remote code execution. Both were responsibly disclosed.

In December 2024, Sophos fixed three Sophos Firewall flaws that could lead to SQL injection, privileged SSH access to devices, and remote code execution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Sophos Firewall)

Tags

Hackinghacking newsinformation security newsIT Information SecurityPierluigi PaganiniSecurity AffairsSecurity NewsSophosSophos Firewall

More Stories>

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAPT

Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback

Australian Police Charge Two Over TeamPCP Credential TheftBreaking News

Australian Police Charge Two Over TeamPCP Credential Theft

Meta to Pay Up to $18B Over Teen Social Media UseBreaking News

Meta to Pay Up to $18B Over Teen Social Media Use

Security>

Hacking>

Malware>