CVE-2020-29574

CyberoamOS (CROS) SQL Injection Vulnerability

Sophos — CyberoamOS

Added to KEV catalog: 6 February 2025
Federal remediation due date: 27 February 2025
Weakness classification (CWE): CWE-89

CISA Description

CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

Required action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Notes

https://support.sophos.com/support/s/article/KBA-000007526 ; https://nvd.nist.gov/vuln/detail/CVE-2020-29574

View on NVD View on MITRE CVE View full CISA catalog

More Sophos Vulnerabilities

CVE-2020-15069

Sophos XG Firewall Buffer Overflow Vulnerability

CVE-2023-1671

Sophos Web Appliance Command Injection Vulnerability

CVE-2022-3236

Sophos Firewall Code Injection Vulnerability

CVE-2022-1040

Sophos Firewall Authentication Bypass Vulnerability

CVE-2020-25223

Sophos SG UTM Remote Code Execution Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services