CVE-2020-29574
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Sophos CyberoamOS
PublishedDec 11, 2020
First seenDec 11, 2020
Added to KEVFeb 6, 2025
Weakness typeCWE-89SQL injection
How to fix
CISA required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA due date: Feb 27, 2025Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sophos cyberoamos | v ≤ 2020-12-04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.