CVE-2025-6704: Sophos Firewall Firmware RCE Vulnerability

CVE-2025-6704 Overview

CVE-2025-6704 is an arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall. This critical vulnerability affects Sophos Firewall versions older than 21.0 MR2 (21.0.2) and can lead to pre-authentication remote code execution when a specific SPX configuration is enabled in combination with the firewall running in High Availability (HA) mode.

Critical Impact

Unauthenticated remote attackers can exploit this arbitrary file write vulnerability to achieve remote code execution on affected Sophos Firewall appliances, potentially gaining complete control of network security infrastructure.

Affected Products

• Sophos Firewall Firmware versions prior to 21.0 MR2 (21.0.2)
• Sophos Firewall hardware appliances running vulnerable firmware
• Deployments with Secure PDF eXchange (SPX) feature enabled in High Availability (HA) mode

Discovery Timeline

• July 21, 2025 - CVE-2025-6704 published to NVD
• August 18, 2025 - Last updated in NVD database

Technical Details for CVE-2025-6704

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), which indicates the underlying mechanism enables command injection through the arbitrary file write primitive. The SPX feature, designed to provide secure email encryption capabilities for Sophos Firewall, contains a flaw that allows attackers to write arbitrary files to the system without authentication.

The vulnerability is particularly dangerous because it requires no user interaction and can be exploited remotely over the network without any prior authentication or privileges. When combined with the firewall operating in High Availability (HA) mode with specific SPX configurations, the arbitrary file write capability can be leveraged to achieve full remote code execution.

Root Cause

The root cause stems from insufficient input validation and access controls within the Secure PDF eXchange (SPX) feature. The SPX component fails to properly sanitize or restrict file write operations, allowing an attacker to specify arbitrary file paths and content. This file write primitive, combined with the elevated privileges under which the firewall services operate, creates a direct path to code execution.

The vulnerability is exacerbated when the firewall is configured in High Availability mode, as the synchronization mechanisms between HA nodes may expose additional attack surface or provide alternative paths for exploiting the file write vulnerability.

Attack Vector

An attacker can exploit CVE-2025-6704 by sending specially crafted requests to the SPX feature of an affected Sophos Firewall appliance. The attack is conducted over the network and requires no authentication, making it particularly dangerous for internet-facing firewall deployments.

The exploitation flow involves:

1. Identifying a Sophos Firewall with SPX enabled and HA mode configured
2. Crafting malicious requests to the SPX endpoint that trigger the arbitrary file write
3. Writing malicious content to a location that enables code execution (e.g., web-accessible directories, scheduled task locations, or configuration files)
4. Triggering execution of the written payload to gain shell access

For detailed technical information regarding the exploitation mechanism, refer to the Sophos Security Advisory.

Detection Methods for CVE-2025-6704

Indicators of Compromise

• Unexpected file creation or modification in system directories on Sophos Firewall appliances
• Anomalous HTTP/HTTPS requests targeting SPX-related endpoints
• Unusual process execution originating from firewall services
• Unauthorized configuration changes on HA-configured firewalls
• Network traffic patterns indicating command and control activity from firewall IP addresses

Detection Strategies

• Monitor Sophos Firewall logs for anomalous SPX-related activity and file system events
• Implement network intrusion detection rules to identify exploitation attempts targeting the SPX feature
• Deploy SentinelOne agents on infrastructure components to detect post-exploitation behavior
• Configure SIEM correlation rules to alert on suspicious activity patterns from firewall management interfaces
• Perform regular integrity verification of Sophos Firewall file systems

Monitoring Recommendations

• Enable comprehensive logging on all Sophos Firewall appliances, particularly for SPX feature activity
• Monitor outbound connections from firewall appliances for indicators of compromise
• Implement file integrity monitoring for critical Sophos Firewall directories
• Review HA synchronization logs for anomalous activity

How to Mitigate CVE-2025-6704

Immediate Actions Required

• Upgrade all Sophos Firewall appliances to version 21.0 MR2 (21.0.2) or later immediately
• Audit current SPX and HA configurations across the environment
• Review firewall logs for indicators of prior exploitation attempts
• Implement network segmentation to limit exposure of firewall management interfaces
• Consider temporarily disabling SPX feature if upgrade cannot be performed immediately

Patch Information

Sophos has released firmware version 21.0 MR2 (21.0.2) which addresses this vulnerability. Organizations should apply this update as soon as possible. Detailed patch information and download links are available in the Sophos Security Advisory.

Given the pre-authentication nature of this vulnerability and its critical severity, patching should be treated as an emergency priority for all affected deployments.

Workarounds

• Disable the Secure PDF eXchange (SPX) feature if not required for business operations until patching is complete
• Restrict network access to firewall management interfaces to trusted administrator networks only
• If HA mode is not essential, consider temporarily reverting to standalone configuration
• Implement additional network-level access controls (ACLs) to limit which systems can communicate with the firewall management plane
• Deploy web application firewall rules upstream if possible to filter potentially malicious requests to SPX endpoints

# Verify current Sophos Firewall version via CLI
system diagnostics show version-info

# Check SPX feature status
show service-status spx

# Review HA configuration status
show ha status