Firewall
Vendor:
First CVE: May 5, 2022 · Active for 4 years
13
Total CVEs
More Total CVEs than 91% of tracked products
3.3
Avg CVEs / Year
Higher CVE frequency than 81% of tracked products
8.7
Avg CVSS
Higher Avg CVSS than 78% of tracked products
7.7%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Firewall over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 5, 2022
4 years ago
Most Recent CVE
Jul 21, 2025
370 days ago
CVE Severity & Scoring
Firewall13 CVEs
62%
38%
All CVEs352,719 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network12 (92.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (7.7%)
Attack Complexity
Low12 (92.3%)
High1 (7.7%)
Unknown0 (0.0%)
User Interaction
None11 (84.6%)
Unknown0 (0.0%)
Required2 (15.4%)
Privileges Required
Low1 (7.7%)
High4 (30.8%)
None8 (61.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-3236CRITICAL A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. | Sep 23, 2022 | 9.8 | 98 | YES | YES |
CVE-2025-6704CRITICAL An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution | Jul 21, 2025 | 9.8 | 35 | NO | NO |
CVE-2025-7624CRITICAL An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining | Jul 21, 2025 | 9.8 | 34 | NO | NO |
CVE-2024-12728CRITICAL A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). | Dec 19, 2024 | 9.8 | 31 | NO | NO |
CVE-2024-12727CRITICAL A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead | Dec 19, 2024 | 9.8 | 31 | NO | NO |
CVE-2024-13974HIGH A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to | Jul 21, 2025 | 8.1 | 28 | NO | NO |
CVE-2024-12729HIGH A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). | Dec 19, 2024 | 8.8 | 28 | NO | NO |
CVE-2021-25268HIGH Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. | May 5, 2022 | 8.4 | 27 | NO | NO |
CVE-2021-25267HIGH Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. | May 5, 2022 | 8.4 | 27 | NO | NO |
CVE-2023-5552HIGH A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) an | Oct 18, 2023 | 7.5 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
1 CVE
7.7% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
7.7% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Firewall
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 19.0 | 1 | 7.2 | 1.0% | 0 | 0 |
| 18.5 | 1 | 7.2 | 1.0% | 0 | 0 |