CVE-2025-7624 — AI Deep Analysis Summary

🚨 **Essence**: A critical SQL Injection (SQLi) flaw in the SMTP proxy. <br>💥 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)**. This is a severe breach allowing full system compromise.

🔍 **Root Cause**: **CWE-89** (SQL Injection). <br>⚠️ **Flaw**: The SMTP proxy fails to properly sanitize user inputs before processing SQL queries, allowing malicious payloads to execute.

🛡️ **Affected**: **Sophos Firewall**. <br>📅 **Version**: All versions **prior to 21.0.2**. If you are running an older build, you are at risk.

💀 **Hacker Power**: <br>🔓 **Privileges**: Full system access via RCE. <br>📂 **Data**: Complete confidentiality and integrity loss. The CVSS score indicates **High** impact on all security metrics.

⚡ **Exploitation Threshold**: **LOW**. <br>🌐 **Network**: Attack Vector is **Network (AV:N)**. <br>🔑 **Auth**: **No Privileges Required (PR:N)**. <br>👁️ **UI**: **No User Interaction (UI:N)**.…

📦 **Public Exploit**: **No**. <br>🚫 **Status**: The `pocs` list is empty. No public Proof-of-Concept (PoC) or wild exploitation code is currently available.

🔎 **Self-Check**: <br>1. Check your Sophos Firewall version. <br>2. Verify if it is **< 21.0.2**. <br>3. Scan for SMTP proxy configurations exposed to the network.

✅ **Official Fix**: **Yes**. <br>🛠️ **Patch**: Upgrade to **Sophos Firewall version 21.0.2** or later. <br>📖 **Ref**: See Sophos Security Advisory SA-20250721-SFOS-RCE.

🚧 **No Patch Workaround**: <br>🚫 **Block SMTP**: Restrict access to the SMTP proxy service. <br>🛑 **WAF**: Use Web Application Firewalls to filter SQL injection patterns in SMTP traffic.…

🔥 **Urgency**: **CRITICAL**. <br>⏳ **Priority**: **Immediate Action Required**. <br>📉 **Risk**: High CVSS score + No Auth Required + RCE capability = Must patch ASAP.