CVE-2024-13973

High · 7.2

CVSS

7.2

EPSS

12.3%

Published

Jul 21, 2025

CISA due date

—

The record

A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.

Affected packages

Ecosystem	Package	Introduced	Fixed