CVE-2025-7624: SQL Injection in Sophos Firewall

The SQL injection vulnerability in Sophos Firewall allows an attacker to inject malicious SQL code into the SMTP proxy's query processing. If a quarantining policy is enabled for email and the firewall was upgraded from a version before 21.0 GA, this injected code can be leveraged to execute arbitrary commands on the firewall itself. This represents a significant escalation of privilege, potentially granting the attacker full control over the firewall and any systems behind it. The impact extends beyond the firewall itself, as a compromised firewall can be used as a pivot point to attack internal network resources, leading to widespread data breaches and system compromise. The ability to execute code directly on the firewall bypasses typical network defenses and makes detection considerably more challenging.

1. Reserved2025-07-14
2. Published2025-07-21
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-7624 is to immediately upgrade Sophos Firewall to version 21.0 MR2 (21.0.2) or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider temporarily disabling the legacy (transparent) SMTP proxy feature. While this will impact email functionality, it will significantly reduce the attack surface. As a further precaution, review and tighten email quarantining policies to minimize the potential impact of a successful SQL injection attempt. Monitor firewall logs for unusual SQL query patterns that might indicate an ongoing attack. Sophos has not released specific WAF rules, but generic SQL injection detection rules can be applied.