CVE-2024-13974 HIGH

CVE-2024-13974

Vendor Sophos

Product Sophos Firewall

Weakness CWE-807

Published July 21, 2025

Last update July 21, 2025

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

Key dates

02Disclosure timeline

July 21, 2025 CVE published

July 21, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-13974 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/807.html

Related vulnerabilities

04Related CVE

CVE-2026-35655 OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution CVE-2025-12488 oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability CVE-2020-5252 Malicious package may avoid detection in python auditing CVE-2026-21514 Microsoft Word Security Feature Bypass Vulnerability CVE-2025-11271 Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation