轉發 台灣電腦網路危機處理暨協調中心 TWCERTCC-200-202507-00000021
[內容說明]
Sophos發布關於防火牆的資安公告，指出旗下的防火牆產品存在3個重大資安漏洞，並提出修補版本，呼籲用戶儘快檢查系統是否套用相關更新。
【CVE-2025-6704，CVSS：9.8】 安全PDF交換(Secure PDF eXchange，SPX)功能存在任意文件寫入漏洞，若啟用SPX的特定配置且防火牆處於高可用性(HA)模式，可能導致預授權遠端程式碼執行。
【CVE-2025-7624，CVSS：9.8】 Legacy (transparent) SMTP proxy存在一項SQL注入漏洞，若電子郵件啟用隔離政策，且系統從21.0 GA之前的版本升級至現有版本，可能導致遠端程式碼執行。
【CVE-2025-7382，CVSS：8.8】 WebAdmin 存在命令注入漏洞，若管理員啟用OTP驗證，則可能導致相鄰攻擊者在高可用性(HA)輔助設備上實現預授權程式碼執行。
[影響平台]
Sophos Firewall v21.5 GA (含)以前版本
[建議措施]
根據官方網站釋出解決方式進行修補：
https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce
[參考資料]
https://www.twcert.org.tw/tw/cp-169-10280-e36be-1.html
Forwarded Taiwan Computer Network Crisis Management and Coordination Center TWCERTCC-200-202507-00000021
[Content Description]
Sophos released a security bulletin about the firewall, pointing out that its firewall products have three major security vulnerabilities, and proposed patch versions, calling on users to check whether the system has applied the relevant updates as soon as possible.
[CVE-2025-6704, CVSS: 9.8] The Secure PDF eXchange (SPX) function has an arbitrary file write vulnerability. If the specific configuration of SPX is enabled and the firewall is in high availability (HA) mode, it may lead to pre-authorized remote code execution.
[CVE-2025-7624, CVSS: 9.8] The Legacy (transparent) SMTP proxy has a SQL injection vulnerability. If the quarantine policy is enabled for email and the system is upgraded from a version before 21.0 GA to the current version, it may lead to remote code execution.
【CVE-2025-7382, CVSS: 8.8】 WebAdmin has a command injection vulnerability. If the administrator enables OTP authentication, it may cause adjacent attackers to achieve pre-authorized code execution on the high availability (HA) secondary device.
[Affected Platform]
Sophos Firewall v21.5 GA (inclusive) and earlier versions
[Recommended measures]
Fix the vulnerability according to the solution released on the official website:
https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce
[References]
https://www.twcert.org.tw/tw/cp-169-10280-e36be-1.html