Overview
In the ongoing struggle to keep our digital environments secure, cybersecurity professionals continually discover new vulnerabilities that can potentially compromise system security. One such vulnerability, recently marked as CVE-2025-7624, affects the legacy SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2). The vulnerability is particularly severe as it can lead to remote code execution if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.
This vulnerability is a grave concern for any organization using the affected Sophos Firewall versions, as it poses a significant risk of system compromise or data leakage. It is of utmost importance to understand this vulnerability and take the necessary steps to mitigate its potential impact.
Vulnerability Summary
CVE ID: CVE-2025-7624
Severity: Critical (9.8 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage upon successful exploitation
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Sophos Firewall | Versions older than 21.0 MR2 (21.0.2)
How the Exploit Works
The exploit takes advantage of an SQL injection vulnerability in the legacy SMTP proxy of the affected Sophos Firewall versions. An attacker could craft a malicious SQL query to trick the system into executing arbitrary SQL commands. When successful, this could lead to remote code execution, potentially giving the attacker full control over the compromised system. This is particularly dangerous if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request, demonstrating how an attacker could inject malicious SQL commands into the system.
POST /smtp_proxy/endpoint HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "email": "admin'; DROP TABLE users; --" }In this example, the attacker is attempting to trick the system into executing the SQL command `DROP TABLE users;` after the legitimate command `admin`. If successful, this would delete the entire ‘users’ database table, potentially causing significant damage.
Mitigation Guidance
Users are advised to apply the vendor patch as soon as possible to mitigate the risk of this vulnerability. If this is not immediately possible, users can use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure, which can help monitor and block potential SQL injection attempts.