CVE-2025-7382

published 2025-07-21

CVE-2025-7382: A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code…

Priority P2 60 high 8.8 CVSS 3.1

AV A AC L PR N UI N S U C H I H A H

A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High Availability (HA) auxiliary devices, if OTP authentication for the admin user is enabled.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sophos	firewall_firmware	< 21.0.2	21.0.2
sophos	sophos_firewall	< 21.0 MR2 (21.0.2)	21.0 MR2 (21.0.2)

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78