A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Sophos UTM (all versions) is affected by a flaw that lets a remote attacker who does not need to log in run arbitrary code with root privileges, giving them full control of the device. The attack can be carried out when the email proxy with scanning is enabled, and the product is end-of-life, so the fix must be applied manually.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Sophos SG UTM
through 9.724