{"id":"CVE-2020-25223","published":"2020-09-25T04:23:04Z","modified":"2026-06-17T03:06:37Z","title":"Sophos SG UTM Remote Code Execution Vulnerability","vendor":"Sophos","product":"SG UTM","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11","provenance":"source","from":"NVD"},"summary":{"text":"The Sophos SG UTM product has a remote code execution flaw in its WebAdmin component, affecting releases before v9.705 MR5, v9.607 MR7, and v9.511 MR11, caused by improper neutralization of special elements used in an OS command. An attacker with network access can exploit it without authentication or user interaction to execute arbitrary code on the affected device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:56Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96753,"percentile":0.99886,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-25223","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-25","exploitedFirstSeen":"2022-03-25","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"},{"url":"https://www.hkcert.org/security-bulletin/multiple-vulnerabilities-in-internet-facing-systems-targeting-hong-kong-s-education-sector_20260724","date":"2026-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-25&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-26&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-29&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2020-25223","date":"2026-09-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-01&host_type=src&vulnerability=cve-2020-25223","date":"2026-10-01"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://community.sophos.com/b/security-blog","tags":["Not Applicable","Vendor Advisory"]},{"url":"https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223","tags":["Vendor Advisory"]},{"url":"https://cwe.mitre.org/data/definitions/78.html","tags":["Technical Description"]},{"url":"https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://community.sophos.com/b/security-blog","tags":["Not Applicable","Vendor Advisory"]},{"url":"https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223","tags":["Vendor Advisory"]},{"url":"https://cwe.mitre.org/data/definitions/78.html","tags":["Technical Description"]},{"url":"https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-25223","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","dataset-annotation"],"basisDetail":"claude-haiku-5-5: Remote exploit against public-facing web administration interface; TRAM2 annotated sentence label","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A remote code execution vulnerability exists in the WebAdmin","start":0,"end":60},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin","start":4458,"end":4753},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.","start":4504,"end":4824}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote code execution yields command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A remote code execution vulnerability exists in the WebAdmin","start":0,"end":60}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin","start":4458,"end":4753}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-17913","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17913","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-08-29","earliestUrl":"https://github.com/darrenmartyn/sophucked","repos":[{"name":"darrenmartyn/sophucked","url":"https://github.com/darrenmartyn/sophucked","stars":11,"created":"2021-08-29"},{"name":"maguireja/CVE-2020-25223","url":"https://github.com/maguireja/CVE-2020-25223","stars":3,"created":"2021-09-09"}]},"metasploit":[{"name":"Sophos UTM WebAdmin SID Command Injection","module":"exploit/linux/http/sophos_utm_webadmin_sid_cmd_injection","type":"exploit","disclosureDate":"2020-09-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sophos_utm_webadmin_sid_cmd_injection.rb"}],"nuclei":[{"id":"CVE-2020-25223","name":"Sophos UTM Preauth - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-25223.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25223.yaml"}],"first":{"date":"2020-09-18","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sophos_utm_webadmin_sid_cmd_injection.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/164697/Sophos-UTM-WebAdmin-SID-Command-Injection.html","https://www.secpod.com/blog/remote-code-execution-in-sophos-utm/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-09-18","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-08-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sophos_utm_webadmin_sid_cmd_injection.rb","provenance":"source"},{"date":"2020-09-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25223","provenance":"source"},{"date":"2022-03-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17913","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":546},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1681 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}