CVE-2020-29574
CyberoamOS (CROS) SQL Injection Vulnerability
Description
CVE-2020-29574 is a critical SQL injection vulnerability in the WebAdmin interface of Sophos CyberoamOS (through December 4, 2020) that allows unauthenticated attackers to execute arbitrary SQL statements remotely. With a CVSS v3.1 base score of 9.8 and an EPSS score of 8.41% at the 92nd percentile, this vulnerability enables complete compromise of the firewall appliance without any authentication. CISA has added CVE-2020-29574 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025, confirming continued active exploitation of unpatched Cyberoam appliances years after the initial disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sophos | cyberoamos | <= 2020-12-04 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
SQL Injection in WebAdmin Interface
CVE-2020-29574 is an SQL injection vulnerability in the WebAdmin management interface of Sophos CyberoamOS. While no specific CWE has been formally assigned, the vulnerability is a classic SQL injection weakness where user-supplied input is incorporated into SQL queries without proper sanitization, parameterization, or input validation. The WebAdmin interface, which provides the web-based management console for Cyberoam firewall appliances, fails to properly handle input in certain request parameters, allowing an unauthenticated attacker to inject arbitrary SQL commands that are executed against the appliance's backend database.
Impact Analysis
CVE-2020-29574 poses an extreme risk to organizations still operating Sophos Cyberoam firewall appliances. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the worst-case exploitation scenario: network-accessible, low complexity, no authentication required, no user interaction needed, with maximum impact on confidentiality, integrity, and availability. Confidentiality (High): SQL injection on a firewall appliance can expose the entire configuration database, including administrator credentials, VPN user accounts, firewall rules, network topology information, and any data stored in the appliance's database. An attacker can extract stored passwords, certificate private keys, and access all management data. Integrity (High): Arbitrary SQL execution allows an attacker to modify the firewall's database, including inserting new administrator accounts, altering firewall rules to permit unauthorized traffic, disabling security features, and potentially escalating to operating system command execution through database-specific features. Availability (High): An attacker can drop tables, corrupt the configuration database, crash the management interface, or modify the firewall configuration to disrupt all network traffic passing through the appliance. The EPSS score of 8.41% at the 92nd percentile confirms elevated exploitation activity. Ransomware association is currently listed as unknown, but compromised firewall appliances provide attackers with unrestricted network access that facilitates ransomware deployment.
Exploit Maturity
CVE-2020-29574 demonstrates high exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming continued active exploitation of Sophos Cyberoam appliances with a mandatory remediation deadline of February 27, 2025. The EPSS score of 8.41% at the 92nd percentile indicates significantly elevated exploitation probability. SQL injection is one of the most well-understood and widely tooled vulnerability classes, with mature automated exploitation frameworks readily available. The combination of unauthenticated access, a web-based management interface typically exposed for remote administration, and the high-value target of a network firewall makes this vulnerability particularly attractive to attackers. Cyberoam products have been absorbed into the Sophos product line, and many legacy Cyberoam appliances may no longer receive regular updates, increasing the population of vulnerable devices. Ransomware use is currently listed as unknown.
Remediation
-
Apply the Sophos security update or migrate to a supported product. Sophos has addressed the SQL injection vulnerability in CyberoamOS. Apply the latest available firmware update for your Cyberoam appliance. If the appliance has reached end-of-life, migrate to a current Sophos XGS Firewall or equivalent supported product. Consult Sophos support for migration guidance.
-
Restrict access to the WebAdmin management interface. Immediately limit access to the Cyberoam WebAdmin interface to trusted management networks only. Block all public internet access to the management port (typically HTTPS on port 443 for WebAdmin) using upstream firewall rules or access control lists on the network perimeter.
-
Rotate all credentials stored on the appliance. Assume that administrator passwords, VPN user credentials, and any other authentication data stored in the Cyberoam database may have been compromised through SQL injection. Reset all administrator accounts, VPN user passwords, pre-shared keys, and certificate private keys configured on the appliance.
-
Conduct a forensic investigation. Review WebAdmin access logs and network traffic for indicators of SQL injection attempts, including unusual query strings, error responses, and anomalous management sessions from unexpected source addresses. Check the appliance configuration for unauthorized administrator accounts, modified firewall rules, or suspicious VPN configurations that may indicate prior exploitation.
-
Implement a migration plan for legacy Cyberoam equipment. Inventory all Cyberoam appliances across the organization and develop a timeline for replacement with current, supported Sophos products. Legacy network security appliances that no longer receive regular security updates represent an ongoing and growing risk to the organization's security posture.
Technical Details
CVE-2020-29574 is an SQL injection vulnerability in the WebAdmin interface of Sophos CyberoamOS. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum severity profile: the vulnerability is exploitable over the network with no authentication or user interaction required, achieving full impact on confidentiality, integrity, and availability. The WebAdmin interface is the primary web-based management console for Cyberoam firewall appliances, typically accessible over HTTPS. The SQL injection vulnerability exists in the processing of request parameters within the WebAdmin application, where user-supplied input is concatenated directly into SQL query strings rather than being passed through parameterized queries or properly sanitized. An unauthenticated remote attacker can send specially crafted HTTP requests to the WebAdmin interface containing SQL injection payloads in vulnerable parameters. These payloads are incorporated into the database queries executed by the WebAdmin application, allowing the attacker to read, modify, or delete data in the appliance's backend database, extract sensitive configuration information, and potentially escalate to operating system command execution through database-specific features such as stored procedures or file system access functions. The vulnerability affects all CyberoamOS versions through December 4, 2020, encompassing the entire deployed base of Cyberoam appliances running unpatched firmware.
Frequently Asked Questions
Is CVE-2020-29574 still being actively exploited?
Yes. Despite being disclosed in 2020, CISA added CVE-2020-29574 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025, confirming that threat actors continue to target unpatched Cyberoam appliances. The EPSS score of 8.41% at the 92nd percentile reflects ongoing exploitation activity.
What is Sophos CyberoamOS?
CyberoamOS is the operating system that powers Cyberoam firewall and unified threat management (UTM) appliances. Cyberoam was acquired by Sophos in 2014, and the Cyberoam product line has been superseded by Sophos XG and XGS series firewalls. Many legacy Cyberoam appliances remain in production despite reaching end-of-life status.
How do I fix CVE-2020-29574?
Apply the latest available firmware update for your Cyberoam appliance. If the device has reached end-of-life and no updates are available, migrate to a supported Sophos XGS Firewall. As an immediate mitigation, restrict all access to the WebAdmin management interface to trusted internal networks only.
Can CVE-2020-29574 be exploited without authentication?
Yes. The vulnerability has a CVSS score of 9.8 and requires no authentication to exploit. An attacker only needs network access to the CyberoamOS WebAdmin interface to execute arbitrary SQL statements against the appliance's database, potentially leading to complete appliance compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.