CVE-2020-25223
Sophos SG UTM Remote Code Execution Vulnerability
Description
CVE-2020-25223 is a critical remote code execution vulnerability in the Sophos SG UTM (Unified Threat Management) WebAdmin portal that allows an authenticated attacker to execute arbitrary operating system commands on the underlying system. The vulnerability exists in the WebAdmin interface, which improperly handles user input in a way that permits OS command injection. CISA has added CVE-2020-25223 to the Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. With an EPSS score of 94.4% (99.4th percentile), this vulnerability poses an immediate risk to organizations relying on Sophos SG UTM appliances for network security.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | unified threat management | < 9.511; >= 9.600, < 9.607; >= 9.700, < 9.705; 9.511; 9.607; 9.705 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://community.sophos.com/b/security-blog(Not Applicable, Vendor Advisory)
- https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223(Vendor Advisory)
- https://cwe.mitre.org/data/definitions/78.html(Technical Description)
- https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2020-25223, the Sophos SG UTM WebAdmin portal fails to properly sanitize user-supplied input, allowing an attacker with access to the administrative interface to inject and execute arbitrary operating system commands on the underlying appliance.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2020-25223 enables remote code execution on Sophos SG UTM appliances, which serve as critical network security gateways for many organizations. A successful exploit allows an attacker to execute arbitrary commands on the underlying operating system, effectively gaining full control of the UTM appliance. Since UTM devices sit at the network perimeter and handle firewall, VPN, intrusion prevention, and web filtering functions, compromise of such a device can give attackers visibility into all network traffic passing through the device, the ability to disable security controls, and a foothold for lateral movement into the protected network. The high EPSS score of 94.4% (99.4th percentile) reflects the widespread and active exploitation of this vulnerability, making immediate remediation critical for all affected deployments.
Exploit Maturity
CVE-2020-25223 is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. The vulnerability has been targeted by advanced threat actors seeking to compromise network perimeter security appliances for persistent access to protected networks. The EPSS score of 94.4% (99.4th percentile) indicates near-certain exploitation probability. Exploitation requires access to the WebAdmin interface, but many organizations expose this interface to the internet for remote management, significantly expanding the attack surface.
Remediation
- Apply the Sophos hotfix or upgrade to a patched firmware version immediately as required by the CISA KEV directive. Consult the Sophos security advisory for the specific patch version applicable to your SG UTM model.
- Restrict access to the WebAdmin interface to trusted management networks only by configuring firewall rules that prevent internet-facing access to the administrative portal.
- Enable two-factor authentication for all WebAdmin administrative accounts to reduce the risk of credential-based attacks that could lead to exploitation of this vulnerability.
- Review WebAdmin access logs and system logs for indicators of compromise, including unexpected command execution, unauthorized configuration changes, or anomalous administrative sessions.
- Implement network segmentation to limit the blast radius if the UTM appliance is compromised, and deploy monitoring to detect unusual traffic patterns or outbound connections originating from the UTM device.
Technical Details
CVE-2020-25223 is an OS command injection vulnerability (CWE-78) in the WebAdmin management portal of Sophos SG UTM appliances. The WebAdmin interface, which provides web-based administration of the UTM device, improperly handles user-supplied input in certain request parameters, allowing injection of arbitrary operating system commands. When the injected commands are processed by the underlying system, they execute with the privileges of the web application process, which typically runs with elevated permissions on the appliance. The vulnerability affects Sophos SG UTM versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. As UTM appliances are network security gateways positioned at the network perimeter, compromise through this vulnerability provides attackers with a strategically valuable position for network surveillance and further attacks.
Frequently Asked Questions
Is CVE-2020-25223 being actively exploited?
Yes, CVE-2020-25223 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.4% (99.4th percentile) confirms high exploitation activity. Organizations running vulnerable Sophos SG UTM appliances with internet-exposed WebAdmin interfaces are at particular risk.
What products are affected by CVE-2020-25223?
CVE-2020-25223 affects Sophos SG UTM appliances running firmware versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. The vulnerability is in the WebAdmin management portal used for web-based administration of the UTM device.
How do I fix CVE-2020-25223?
Apply the Sophos security hotfix or upgrade to a patched firmware version as directed by the Sophos security advisory. Immediately restrict WebAdmin access to trusted management networks only, and enable two-factor authentication for all administrative accounts.
How severe is CVE-2020-25223?
CVE-2020-25223 is rated CRITICAL as it enables remote code execution on network security gateway appliances. The EPSS score of 94.4% (99.4th percentile) indicates near-certain exploitation. Compromise of a UTM appliance gives attackers control over a device that handles all network security functions, making this a high-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.