Loading vulnerability…
CVE-2020-25223 is an unauthenticated remote code execution vulnerability in Sophos SG/UTM WebAdmin affecting versions before 9.705 MR5, 9.607 MR7, and 9.511 MR11. The vulnerable request flow accepts a user-controlled SID value in unauthenticated JSON POST requests handled by the WebAdmin frontend and forwards that value to backend session-handling logic. The SID is ultimately incorporated into a filesystem path used to restore session state, where Perl Storable::lock_retrieve is invoked on a filename derived from the attacker-supplied SID. Because the underlying Perl open() behavior can treat specially crafted input as a command, insufficient validation of the SID allows command injection and remote code execution. A patch added validation restricting SID values to alphanumeric characters. The issue could be reached pre-authentication when WebAdmin was exposed, and a request path handling discrepancy allowed bypass of an input-rewriting defense intended to neutralize malicious SID values.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module: 'Sophos UTM WebAdmin SID Command Injection'. The module exploits a command injection vulnerability (CVE-2020-25223) in the Sophos UTM WebAdmin interface. The exploit works by sending a specially crafted POST request to the '/var' endpoint, injecting shell commands into the 'SID' parameter. The module supports both direct command execution and staged payload delivery (e.g., Meterpreter), running commands as root. The exploit is highly weaponized, leveraging Metasploit's payload and session management. The code is written in Ruby and follows standard Metasploit module structure, with options for target URI, payload selection, and port configuration. The default configuration uses SSL and port 4444, with a recommendation to use LPORT=443 to bypass egress filtering. The exploit is operational and can provide full remote code execution on vulnerable Sophos UTM appliances.
This repository contains a proof-of-concept Python script (CVE-2020-25223.py) and a README file. The script targets Sophos UTM devices vulnerable to CVE-2020-25223, exploiting a command injection vulnerability in the management interface (HTTPS on port 4444). The exploit works by sending a crafted POST request to the /var endpoint, injecting a command to copy the /etc/shadow file to a web-accessible location. It then downloads the file via a GET request and cleans up by deleting the temporary file. The script demonstrates the ability to exfiltrate sensitive system files from affected devices. The repository is structured simply, with the main exploit logic contained in a single Python file and a brief README describing its purpose.
This repository contains a Python 2 exploit script (sophucked.py) and a README.md for CVE-2020-25223, a pre-authentication remote code execution vulnerability in Sophos UTM 9. The exploit targets the web admin interface (typically on port 4443 over HTTPS) and leverages a flaw in the backend to execute arbitrary commands as root. The script works by sending a specially crafted POST request to the /var endpoint of the target, injecting a bash reverse shell command that connects back to the attacker's specified host and port. The script also includes a handler that listens for the incoming reverse shell connection and provides an interactive root shell to the attacker. The README provides usage instructions, post-exploitation notes, and references to the official advisory and third-party analysis. No detection or scanning functionality is included; the script is purely for exploitation. The exploit is operational, providing a working reverse shell payload, and is not part of a larger framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as part of repository names in attacker infrastructure/IoCs; no vulnerability details are provided in the content.
A command injection vulnerability in Sophos UTM 9 WebAdmin SID, for which detection artifacts and exploit code exist.
A vulnerability in WebAdmin of Sophos SG UTM that Zerobot 1.1 includes for exploitation.
An unauthenticated remote code execution vulnerability in Sophos SG/UTM WebAdmin where a user-controlled session identifier (SID) can be leveraged to trigger command execution through unsafe Perl file handling (open() semantics) in the backend session retrieval path; exploitation can be achieved pre-auth and results in root-level code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.