CVE-2024-13973 Overview
CVE-2024-13973 is a post-authentication SQL injection vulnerability [CWE-89] in the WebAdmin interface of Sophos Firewall. The flaw affects versions older than 21.0 MR1 (21.0.1). An authenticated administrator can inject SQL statements that potentially lead to arbitrary code execution on the firewall.
The issue was disclosed in the Sophos security advisory sophos-sa-20250721-sfos-rce and requires administrator-level privileges to exploit. The EPSS score of 8.344% places it in the 94th percentile for exploitation likelihood among published CVEs.
Critical Impact
An authenticated administrator can execute arbitrary code on the firewall appliance, compromising the confidentiality, integrity, and availability of the perimeter security device.
Affected Products
- Sophos Firewall Firmware versions older than 21.0 MR1 (21.0.1)
- Sophos Firewall hardware appliances running affected firmware
- Sophos Firewall virtual and software deployments running affected firmware
Discovery Timeline
- 2025-07-21 - CVE-2024-13973 published to NVD and Sophos security advisory released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13973
Vulnerability Analysis
The vulnerability is a SQL injection flaw in the WebAdmin management interface of Sophos Firewall. WebAdmin is the browser-based console used by administrators to configure firewall policies, VPN, users, and system settings. The vulnerable code path incorporates user-supplied input into an SQL query without sufficient validation or parameterization.
Because the SQL layer on the appliance interacts with system components used to persist configuration, a successful injection can pivot beyond database manipulation. Sophos states the flaw can potentially lead to arbitrary code execution by an administrator. The advisory identifier sophos-sa-20250721-sfos-rce reflects this remote code execution outcome.
Exploitation requires the attacker to already possess valid administrator credentials for the WebAdmin interface. This raises the required privilege but does not eliminate risk. Credential theft, phishing against firewall administrators, and reuse of leaked passwords are recognized attack paths that satisfy this precondition.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input received through WebAdmin is concatenated into SQL statements executed by the firewall backend. Standard parameterized queries or prepared statements would have prevented the injection.
Attack Vector
The attack vector is network-based against the WebAdmin service. An attacker authenticated as an administrator submits crafted parameters through WebAdmin requests. The injected SQL alters query semantics and, per the vendor advisory, can be leveraged to reach arbitrary code execution on the appliance.
Refer to the Sophos Security Advisory for vendor technical details. No public proof-of-concept exploit is available at this time.
Detection Methods for CVE-2024-13973
Indicators of Compromise
- Unexpected administrator logins to WebAdmin from unfamiliar source IP addresses or geographies
- WebAdmin request logs containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in parameter values
- New or modified administrator accounts, firewall rules, or VPN configurations that do not match change-management records
- Outbound connections from the firewall appliance itself to unexpected hosts, indicating post-exploitation activity
Detection Strategies
- Enable and forward Sophos Firewall audit logs and WebAdmin access logs to a central SIEM for analysis
- Alert on administrator authentication events followed by rapid submission of parameterized WebAdmin requests containing SQL syntax
- Baseline normal administrator behavior and flag deviations such as off-hours logins or high-volume configuration reads
Monitoring Recommendations
- Restrict WebAdmin exposure to trusted management networks and monitor any access from outside those ranges
- Correlate firewall administrator activity with identity provider logs to identify compromised or shared credentials
- Review firmware version inventory continuously to confirm all Sophos Firewall instances are running 21.0 MR1 or later
How to Mitigate CVE-2024-13973
Immediate Actions Required
- Upgrade Sophos Firewall to version 21.0 MR1 (21.0.1) or later, as specified in the vendor advisory
- Rotate all Sophos Firewall administrator credentials and enforce multi-factor authentication for WebAdmin access
- Audit administrator accounts and remove any that are unused, shared, or unauthorized
- Restrict WebAdmin access to a dedicated management network and block WAN exposure
Patch Information
Sophos has released fixed firmware in version 21.0 MR1 (21.0.1) and later. Details and download guidance are available in the Sophos Security Advisory sophos-sa-20250721-sfos-rce. Customers using auto-update receive the fix without manual action, but administrators should verify installed firmware versions.
Workarounds
- Disable WebAdmin exposure on WAN interfaces if patching cannot be performed immediately
- Limit WebAdmin access using local service ACLs so only specific management IP addresses can reach the interface
- Enforce strong, unique passwords and MFA on every administrator account to reduce the likelihood of credential-based prerequisites being met
# Verify current Sophos Firewall firmware version via console
system diagnostic show version
# Confirm WebAdmin is not exposed on WAN in device services (WebAdmin > Administration > Device Access)
# Ensure the 'HTTPS' checkbox for the WAN zone under Admin Services is unchecked
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
