Cyber Resilience

CVE-2024-13974

High

Published: 21 July 2025

Published
21 July 2025
Modified
17 November 2025
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0128 80.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13974 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Sophos Firewall Firmware. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13974 is a business logic vulnerability (CWE-807) in the Up2Date component of Sophos Firewall versions older than 21.0 MR1 (v20.0.1). This flaw allows attackers to manipulate the firewall's DNS environment, potentially leading to remote code execution (RCE). The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility and significant impacts on confidentiality, integrity, and availability.

Remote attackers without privileges can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation enables control over the firewall's DNS settings, culminating in arbitrary code execution on the affected device, which could compromise the entire firewall and connected networks.

The Sophos security advisory (https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce) recommends updating to Sophos Firewall version 21.0 MR1 (v20.0.1) or later to mitigate the issue, as this release addresses the business logic flaw in the Up2Date component.

EU & UK References

Vulnerability details

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote exploitation of a public-facing firewall component (Up2Date) enabling arbitrary code execution over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-7624Same product: Sophos Firewall
CVE-2025-7382Same product: Sophos Firewall
CVE-2025-6704Same product: Sophos Firewall
CVE-2026-29134Shared CWE-807
CVE-2025-49827Shared CWE-807
CVE-2026-32975Shared CWE-807
CVE-2025-13926Shared CWE-807
CVE-2026-35670Shared CWE-807
CVE-2026-27707Shared CWE-807
CVE-2026-43935Shared CWE-807

Affected Assets

sophos
firewall firmware
≤ 21.0.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly remediates the business logic vulnerability in the Sophos Firewall Up2Date component by requiring timely patching to version 21.0 MR1 or later as recommended by the vendor advisory.

detect

Enables proactive identification of Sophos Firewall instances vulnerable to CVE-2024-13974 through continuous vulnerability scanning, facilitating patch deployment before exploitation.

prevent

Mitigates the business logic flaw (CWE-807) by validating inputs to the Up2Date component, preventing attackers from manipulating the firewall's DNS environment.

References