An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for

The SQL injection vulnerability in Sophos Firewall allows an attacker to inject malicious SQL code into the SMTP proxy's query processing. If a quarantining policy is enabled for email and the firewall was upgraded from a version before 21.0 GA, this injected code can be leveraged to execute arbitrary commands on the firewall itself. This represents a significant escalation of privilege, potentially granting the attacker full control over the firewall and any systems behind it. The impact extends beyond the firewall itself, as a compromised firewall can be used as a pivot point to attack internal network resources, leading to widespread data breaches and system compromise. The ability to execute code directly on the firewall bypasses typical network defenses and makes detection considerably more challenging.

Organizations relying on Sophos Firewall for email security, particularly those with active email quarantining policies and legacy firewall deployments (versions older than 21.0 GA), are at significant risk. Shared hosting environments where multiple customers share a single Sophos Firewall instance are also vulnerable, as a compromise of one customer's email could potentially impact others.

• sophos: Examine Sophos Firewall logs for unusual SQL query patterns, specifically targeting the SMTP proxy. Look for queries containing SQL keywords like UNION, SELECT, INSERT, UPDATE, or DELETE.

Get-SophosFirewallLog -LogType 'SQLInjection' -StartTime (Get-Date).AddDays(-7)

• linux / server: Monitor system logs (e.g., /var/log/syslog, /var/log/messages) for suspicious processes or network connections originating from the Sophos Firewall. Use lsof or ss to identify processes listening on unusual ports or connecting to unexpected destinations.

lsof -i :25 | grep sophos

• generic web: If the SMTP proxy is exposed externally, use curl or wget to probe for potential injection points. Examine response headers for unexpected SQL error messages.

curl -H "X-Custom-Header: '; DROP TABLE users; --" http://sophosfirewall/smtp_proxy

1. 2025-07-21Disclosure

   disclosure

1. Gereserveerd2025-07-14
2. Gepubliceerd2025-07-21
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-7624 is to immediately upgrade Sophos Firewall to version 21.0 MR2 (21.0.2) or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider temporarily disabling the legacy (transparent) SMTP proxy feature. While this will impact email functionality, it will significantly reduce the attack surface. As a further precaution, review and tighten email quarantining policies to minimize the potential impact of a successful SQL injection attempt. Monitor firewall logs for unusual SQL query patterns that might indicate an ongoing attack. Sophos has not released specific WAF rules, but generic SQL injection detection rules can be applied.