PT-2025-30271 · Sophos · Sophos Firewall

Published 2025-07-21 · Updated 2025-08-27 · CVE-2025-6704

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR2 (21.0.2)

Description An arbitrary file writing vulnerability exists in the Secure PDF eXchange (SPX) feature. This issue can lead to pre-authentication remote code execution when a specific SPX configuration is enabled in combination with the firewall operating in High Availability (HA) mode.

Recommendations Update Sophos Firewall to version 21.0 MR2 (21.0.2) or later.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14340

CVE-2025-6704

Affected Products

Sophos Firewall

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2025-6704 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6704 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-6704 · Security Note
• https://bdu.fstec.ru/vul/2025-14340 · Security Note
• https://sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce · Vendor Advisory
• https://twitter.com/dCypherIO/status/1948367625936855362 · Twitter Post
• https://twitter.com/justproton/status/1949817232185282985 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1948405001329557760 · Twitter Post
• https://twitter.com/shah_sheikh/status/1948132494848503986 · Twitter Post
• https://twitter.com/_F2po_/status/1948418471366181343 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1m8axkt/critical_rce_flaws_in_sophos_and_sonicwall · Reddit Post
• https://twitter.com/VisiumAnalytics/status/1949903137818759635 · Twitter Post
• https://twitter.com/Komodosec/status/1960719765028397192 · Twitter Post
• https://twitter.com/StealthEntry/status/1948782510701220277 · Twitter Post
• https://t.me/true_secator/7266 · Telegram Post