CVE-2024-13974
BaseFortify
Publication date: 2025-07-21
Last updated on: 2025-11-17
Assigner: Sophos Limited
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sophos | firewall_firmware | to 21.0.1 (exc) |
| sophos | firewall | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-807 | The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a business logic flaw in the Up2Date component of Sophos Firewall versions older than 21.0 MR1 (20.0.1). It allows attackers to manipulate the firewall's DNS environment, which can lead to remote code execution on the firewall.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain control over the firewall's DNS environment and execute code remotely. This can compromise the firewall's security, potentially allowing unauthorized access, disruption of network traffic, or further attacks within the protected network.