PatchSiren

PatchSiren cyber security CVE debrief

CVE-2020-25223 Sophos CVE debrief

CVE-2020-25223 is a remote code execution vulnerability affecting Sophos SG UTM. CISA lists it in the Known Exploited Vulnerabilities catalog, which means it has been observed as actively exploited. The available corpus does not provide root-cause or version-range details, so the safest response is to follow Sophos vendor guidance and apply updates without delay.

Vendor
Sophos
Product
SG UTM
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-25
Original CVE updated
2022-03-25
Advisory published
2022-03-25
Advisory updated
2022-03-25

Who should care

Sophos SG UTM administrators, security operations teams, vulnerability management owners, and incident responders responsible for internet-facing security appliances should prioritize this CVE.

Technical summary

The source corpus identifies CVE-2020-25223 as a Sophos SG UTM remote code execution vulnerability. CISA’s KEV entry confirms it as a known exploited issue and instructs affected users to apply updates per vendor instructions. No additional technical details, affected-version data, or exploit mechanics are included in the supplied sources.

Defensive priority

Urgent

Recommended defensive actions

  • Apply Sophos updates per vendor instructions as soon as possible.
  • Verify whether any Sophos SG UTM systems are present in the environment, including legacy or externally managed appliances.
  • Prioritize exposure review for any affected SG UTM instance reachable from untrusted networks.
  • Check security monitoring and logs for suspicious activity around SG UTM management or service access.
  • Use the CISA KEV catalog and vendor guidance to confirm remediation status and track closure.

Evidence notes

Evidence is limited to the supplied official records: the CISA KEV entry lists Sophos SG UTM with dateAdded 2022-03-25 and dueDate 2022-04-15, and its notes point to the NVD record for CVE-2020-25223. The CVE.org and NVD links corroborate the vulnerability identifier and title. No unsupported exploit details, affected versions, or remediation steps beyond vendor updates are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2020-25223 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2020-25223

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2020-25223 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2020-25223

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.