CVE-2024-13974

Published Jul 21, 2025

Last updated 4 months ago

CVSS high 8.1
Business logic

Overview

Description
A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to achieve remote code execution.
Source
security-alert@sophos.com
NVD status
Analyzed
Products
firewall_firmware

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.9
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

security-alert@sophos.com
CWE-807

Social media

Hype score
Not currently trending

Configurations