Sophos SG UTM - Remote Code Execution (CVE-2020-25223)

Sophos SG UTM is affected by a Remote Code Execution, located on the WebAdmin endpoint. Vulnerable versions are before v9.705 MR5, v9.607 MR7 and v9.511 MR11. The root cause of this vulnerability consists in using a dangerous function like open() in Perl, when user-supplied input is passed as a argument to the function. This allows a malicious unaunthenticated attacker to execute arbitrary code on the server.

The risk exists that a remote unauthenticated attacker can fully compromise the Sophos UTM in order to steal confidential information, install ransomware or pivot to the internal network.

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

Upgrade the Sophos UTM to a version equal or higher than 9.705 or 9.607 or 9.511.

https://nvd.nist.gov/vuln/detail/CVE-2020-25223

https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-in-sg-utm-webadmin-cve-2020-25223