CVE-2020-25223: Sophos SG UTM WebAdmin OS command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network RCE, CISA KEV listing, and near-certain EPSS probability make this an urgent patch-first issue.

What it is

Sophos SG UTM WebAdmin contains an OS command injection flaw (CWE-78) that permits remote code execution. It affects versions before v9.705 MR5, v9.607 MR7, and v9.511 MR11. Because the WebAdmin interface is network-exposed and the flaw is trivially reachable, it is a high-value target for edge-device compromise.

Impact

An unauthenticated remote attacker can execute arbitrary operating system commands on the UTM appliance, gaining full control of the device. That control can be used to pivot into the protected network or to disable security controls.

Attack surface

Reached over the network through the WebAdmin interface (AV:N, PR:N, UI:N), so no authentication or user interaction is required. Any internet- or network-exposed WebAdmin service is directly in scope.

Exploitation

CVE-2020-25223 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.96693 (99.88th percentile), with public exploit references tagged Exploit. This indicates active exploitation in the wild and a very high likelihood of attempted exploitation.

What to do

• Apply the vendor updates that resolve the issue: upgrade to v9.705 MR5, v9.607 MR7, or v9.511 MR11 (or later) as applicable.
• Restrict access to the WebAdmin interface to trusted management networks; do not expose it to the internet.
• Place WebAdmin behind a VPN or jump host and enforce strong authentication and network ACLs.
• Monitor vendor advisories and apply subsequent SG UTM security updates promptly.
• If immediate patching is not possible, isolate or disable the WebAdmin service until the update can be applied.

Detection

• Inspect WebAdmin and system logs for unexpected command execution, shell metacharacters, or anomalous child processes spawned by the web service.
• Alert on outbound connections or new listening services originating from the UTM appliance that are not part of normal operations.
• Hunt for known exploit artifacts or payload patterns associated with the public PoC (e.g., packetstorm exploit) in HTTP requests to WebAdmin endpoints.
• Monitor for unauthorized configuration changes, new admin accounts, or disabled logging on the appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.