CVE-2025-7624
Published: 21 July 2025
Summary
CVE-2025-7624 is a critical-severity SQL Injection (CWE-89) vulnerability in Sophos Firewall Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
An SQL injection vulnerability exists in the legacy transparent SMTP proxy component of Sophos Firewall. It affects all versions prior to 21.0 MR2 (21.0.2) when a quarantining policy is active for email and the appliance was upgraded from a release older than 21.0 GA. The flaw is tracked as CWE-89 and carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can exploit the issue over the network to achieve arbitrary code execution. No user interaction or credentials are required, and the attack surface is exposed whenever the vulnerable SMTP proxy configuration is in use.
The vendor advisory at https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce identifies the fixed release as Sophos Firewall 21.0 MR2 and states that earlier versions should be updated to eliminate the vulnerability. The associated EPSS score remains low and unchanged at 0.0118 with no observed upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22085
Vulnerability details
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version…
more
older than 21.0 GA.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in public-facing SMTP proxy enables unauthenticated remote exploitation of the firewall application, leading to RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely patching of the SQL injection flaw in the legacy SMTP proxy of Sophos Firewall versions older than 21.0 MR2.
SI-10 enforces validation of SMTP inputs to prevent injection of malicious SQL payloads into the proxy's database queries.
CM-7 restricts the firewall to least functionality by disabling the legacy transparent SMTP proxy and unnecessary email quarantining policies required for exploitation.