Sophos and SonicWall Address Critical RCE Vulnerabilities in Firewalls and SMA 100 Devices
On July 24, 2025, cybersecurity firms Sophos and SonicWall issued urgent security warnings regarding significant vulnerabilities discovered in the Sophos Firewall and Secure Mobile Access (SMA) 100 Series devices. The flaws present a critical risk, allowing potential remote code execution (RCE) that could severely compromise network security if exploited.
Two primary vulnerabilities were identified in Sophos Firewall, both possessing a high Common Vulnerability Scoring System (CVSS) score of 9.8, indicating an urgent requirement for remediation. The first, designated CVE-2025-6704, pertains to an arbitrary file write issue within the Secure PDF eXchange (SPX) feature. This vulnerability becomes especially dangerous when a specific configuration of SPX is activated alongside the firewall operating in High Availability (HA) mode. While Sophos reports that only about 0.05% of devices are affected by this flaw, the severity cannot be underestimated.
The second vulnerability, CVE-2025-7624, targets an SQL injection weakness in the legacy (transparent) SMTP proxy of the firewall. This issue is particularly critical for users who have an active quarantining policy for emails and have upgraded their systems from a version prior to 21.0 GA. Approximately 0.73% of devices could be impacted by this vulnerability, further underscoring the urgent need for a patch.
In response to these findings, Sophos has developed and deployed updates to mitigate these vulnerabilities, alongside addressing a high-severity command injection issue. The swift action taken by both Sophos and SonicWall highlights the seriousness of maintaining robust cybersecurity practices, particularly for businesses that rely on these tools for network security.
These vulnerabilities pose a significant threat to organizations that fail to update their systems promptly. Attackers employing tactics such as initial access via exploited vulnerabilities could leverage these weaknesses, as outlined in the MITRE ATT&CK framework. Techniques such as privilege escalation may also come into play, enabling further exploitation if an attacker gains access to the network environment.
While Sophos has indicated a relatively small percentage of affected devices, the pervasive nature of cyber threats means that even a small window of vulnerability can lead to larger-scale issues. Businesses are urged to consult their system logs, check their configurations, and ensure that recent updates are applied without delay. The landscape of cybersecurity is constantly evolving, and staying one step ahead is essential for risk mitigation.
As organizations increasingly pivot to remote work and cloud services, vulnerabilities like these serve as stark reminders of the security challenges that accompany technological advancements. Business owners must prioritize regular security assessments and updates to safeguard their operations against these persistent threats.
In summary, the recent disclosures surrounding Sophos Firewall and SMA 100 vulnerabilities reveal significant risks to network integrity. By understanding the implications of threat vectors and applying relevant updates, companies can better protect themselves in an increasingly hostile digital environment. Keeping abreast of such developments is crucial for any business leader dedicated to maintaining their cybersecurity posture.
