8.1High
CVE-2024-13974
Description
A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.
Weakness (CWE):
CWE-807
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sophos | firewall firmware | < 21.0.1 | |
| Sophos | Sophos Firewall | < 21.0 MR1 (21.0.1) |
References and patches
CPE matches (NVD) (1)
cpe:2.3:o:sophos:firewall_firmware:*:*:*:*:*:*:*:*< 21.0.1