CVE-2020-29574

Sophos CyberoamOS: (CROS) SQL Injection

As of , CVE-2020-29574 in Sophos CyberoamOS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 6 February 2025
US federal deadline
27 February 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
KnownCISA changed it from Unknown to Known on 14 August 2026.
EPSS score
0.05Higher than 91% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.00 on 6 February 2025EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: support.sophos.comLinks below, from CISA's entry.

What CISA says to do

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

CISA's required action

What the flaw is

CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

CISA's description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

The CVE record's description, from mitre

CVE published
11 December 2020
Assigned by
mitre
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Ransomware use: Unknown to Known.

Read further