Critical · published July 21, 2025
🚨 An arbitrary file writing flaw lurking in Sophos Firewall could allow attackers to execute remote code before authentication, turning a secure fortress into a vulnerability playground! 🔥 Imagine a security guard at a bank who’s supposed to check every bag coming in, but instead, they leave a side door wide open. Anyone can slip in a fake vault with a few clever moves, and suddenly, you've got a heist on your hands! This vulnerability allows attackers to execute commands on the firewall without needing to log in, potentially compromising the entire network. If exploited, it could lead to unauthorized access, data breaches, or even manipulation of network traffic, leaving your resources exposed to malicious intent.
Imagine a security guard at a bank who’s supposed to check every bag coming in, but instead, they leave a side door wide open. Anyone can slip in a fake vault with a few clever moves, and suddenly, you've got a heist on your hands! This vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions prior to 21.0 MR2 (21.0.2) enables an attacker running the firewall in High Availability mode to write arbitrary files, facilitating remote code execution before authentication.
This vulnerability allows attackers to execute commands on the firewall without needing to log in, potentially compromising the entire network. If exploited, it could lead to unauthorized access, data breaches, or even manipulation of network traffic, leaving your resources exposed to malicious intent. To secure your system, update your Sophos Firewall to version 21.0 MR2 (21.0.2) or later immediately. Additionally, review your configuration settings for SPX, especially if running in High Availability mode, to ensure they align with best security practices. Don't wait—this is critical! You’ve got this! Follow these steps to lock down your firewall and keep your network safe! 🛡️