CVE-2024-13974CWE-807

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the…

High · published July 21, 2025

CVSS v3.1
8.1
EPSS
9%
Percentile
95.3
In the wild
Unconfirmed
What it is

A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09069 · 95.3th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2025-07-21T13:34Z
EPSS history
Timeline
  • 21 JUL 13:34Z
    A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the…
    cvelistv5