CVE-2025-7624 CRITICAL

CVE-2025-7624

Vendor Sophos
Product Sophos Firewall
Weakness CWE-89 · SQLi
Published July 21, 2025
Last update July 21, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.

Key dates

02Disclosure timeline

July 21, 2025 CVE published
July 21, 2025 Record updated