Medium
CVSS 6.8
Overview
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.
CVE-2024-13973
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions ...
Risk analysis
This vulnerability is rated 🟡 MEDIUM.
- CVSS: 6.8 (MEDIUM)
- Detected tags: rce, sql (tag impact: VERY HIGH)
Recommended actions:
- Patch/upgrade immediately (remote code execution).
- Reduce exposure (WAF/segmentation), minimize attack surface.
- Use parameterized queries/ORM (avoid string concatenation).
- Add WAF rules and input validation.