Vulnerability record · CVE-2020-29574 · published 11 December 2020
CVE-2020-29574: Cyberoam OS WebAdmin unauthenticated SQL injection
Sophos · Cyberoamos
Cyberoam OS WebAdmin contains a SQL injection flaw that lets unauthenticated remote attackers run arbitrary SQL statements. The product is end-of-life, so no fix path exists and the exposure is severe for any internet-facing management interface.
Description
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote SQL injection with a 9.8 CVSS score, KEV listing, and documented ransomware use against an end-of-life product.
What it is
Cyberoam OS WebAdmin contains a SQL injection flaw that lets unauthenticated remote attackers run arbitrary SQL statements. The product is end-of-life, so no fix path exists and the exposure is severe for any internet-facing management interface.
Impact
An attacker can read or modify the backend database and potentially execute arbitrary SQL, which can lead to full compromise of the appliance's data and management functions.
Attack surface
Reachable over the network through the WebAdmin interface with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Listed in CISA KEV with known ransomware campaign use, and EPSS shows a 30-day probability of about 4.7 percent (91st percentile).
What to do
- Discontinue use of Cyberoam OS as directed by CISA; the product is end-of-life and no patch is available.
- Remove or block external access to the WebAdmin interface immediately.
- Restrict WebAdmin to trusted management networks and require VPN or equivalent access control.
- Replace the appliance with a supported product and migrate configurations.
- Monitor for SQL injection attempts against the WebAdmin endpoint until decommissioning is complete.
Detection
- Inspect WebAdmin access logs for SQL metacharacters or malformed parameters in requests.
- Alert on unauthenticated requests to WebAdmin endpoints from unexpected source addresses.
- Monitor database and appliance logs for anomalous SQL execution or error patterns.
- Hunt for known exploitation indicators against Cyberoam OS WebAdmin in network and proxy telemetry.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-29574 to the Known Exploited Vulnerabilities catalog on 6 February 2025 as "CyberoamOS (CROS) SQL Injection Vulnerability". CISA reports known use in ransomware campaigns. Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Federal deadline 27 February 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/ | Third Party Advisory |
| https://www.cyberoam.com/ngfw.html | Product |
| https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/ | Third Party Advisory |
| https://www.cyberoam.com/ngfw.html | Product |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29574 | US Government Resource |
Track CVE-2020-29574 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-29574), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
