CVE-2020-29574
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
do firstThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Can a WAF block it? Yes. The vulnerability is an SQL injection in the web administration interface, which is accessed via HTTP requests. A WAF can detect typical SQL injection patterns, but some legitimate requests might contain similar syntax, so filtering is only partly reliable. A custom WAF rule can filter SQL injection syntax in WebAdmin HTTP requests, but attackers can vary the request. No tracked WAF vendor has published a rule for this CVE yet.
What a custom rule would match: SQL injection syntax in WebAdmin HTTP requests
Also consider: patch · custom WAF rule · parameterized queries · ORM
Based on an AI reading of the CVE description, and no vendor rule found yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Is CVE-2020-29574 being exploited?
Yes. CVE-2020-29574 appears in CISA's Known Exploited Vulnerabilities catalog, which means exploitation in the wild has been confirmed and reported. Treat it as active rather than theoretical, and patch it ahead of higher-scoring vulnerabilities that carry no exploitation evidence.
How severe is CVE-2020-29574?
CVE-2020-29574 is rated Critical with a CVSS score of 9.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2020-29574?
Not known from our data. No patch reference has been recorded for CVE-2020-29574, which is not the same as no patch existing — a fix may have shipped without a tagged reference, or after this record was written. The vendor advisory is the only authority on whether a fix exists, and mitigations may be available regardless.
What does CVE-2020-29574 affect?
CVE-2020-29574 affects sophos:cyberoamos. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
cisa ssvc
- exploitation
- active
- automatable
- yes
- technical impact
- total
Assessed by CISA 7 Feb 2025 (SSVC 2.0.3).
timeline
- 11 Dec 2020Published
- 6 Feb 2025Added to CISA KEV (exploited in the wild) · 1,517 days (about 4 years) later
- 7 Feb 2025CISA SSVC assessment: exploitation active · 1 day later
- 27 Feb 2025CISA remediation due date (US federal agencies) · 20 days later
- 15 Aug 2026CVE record last updated · 534 days (about 1 year) later
- 2 Nov 2026Analysed by vulneraibility.com · 80 days (about 3 months) later
- Linkcyberoam.com /ngfw.html
- Linkbleepingcomputer.com /news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/
- Linkcisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29574
sources
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA KEV catalog: exploitation, date added, due date
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
- Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.