Critical · published July 21, 2025
🚨 A sneaky SQL injection in Sophos Firewall’s legacy SMTP proxy can open the door to remote code execution! 🔥 Think of this vulnerability as a misfiled piece of mail that accidentally gets delivered to the wrong department. If someone's not careful, sensitive information could end up in the hands of the wrong people, just like an unnoticed package slipping through an unguarded back entrance. An attacker could gain complete control over the system, allowing them to run any code they choose. This means they could read sensitive data, modify configurations, or even launch additional attacks, putting your entire network at risk.
Think of this vulnerability as a misfiled piece of mail that accidentally gets delivered to the wrong department. If someone's not careful, sensitive information could end up in the hands of the wrong people, just like an unnoticed package slipping through an unguarded back entrance. This vulnerability allows remote code execution through an SQL injection in the legacy (transparent) SMTP proxy of Sophos Firewall versions prior to 21.0 MR2 (21.0.2), provided there's a quarantining policy active for emails, and the firewall was upgraded from a version older than 21.0 GA.
An attacker could gain complete control over the system, allowing them to run any code they choose. This means they could read sensitive data, modify configurations, or even launch additional attacks, putting your entire network at risk. Upgrade your Sophos Firewall to version 21.0 MR2 (21.0.2) immediately to safeguard against this vulnerability. Additionally, review your email quarantining policy and ensure proper security measures are in place to protect your system. You've got this! With a quick update, you'll regain control and keep your environment secure. 🛡️