CyberoamOS (CROS) SQL Injection Vulnerability (CVE-2020-29574)

What is affected, what to do

This vulnerability allows an unauthenticated attacker to execute arbitrary SQL statements remotely via an SQL injection in CyberoamOS (CROS) WebAdmin. It is actively exploited in ransomware campaigns since 2023. Affected versions are up to and including 2020-12-04. An immediate update to the latest version is critical to mitigate this security risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Sophos CyberoamOS (CROS) lte *..2020-12-04

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every Cyberoam appliance running CyberoamOS (CROS), including legacy boxes at branch sites, in OT networks and those run by MSPs. All builds up to and including 2020-12-04 are affected.
   • Remove WebAdmin from the internet: Disable administrative access to WebAdmin (HTTP/HTTPS, default TCP 80/443, may be customised) on all WAN zones immediately. In "Appliance Access" or the device access matrix, allow only a dedicated management network.
   • Verify hotfix status: Sophos released a hotfix delivered through the automatic update mechanism. Confirm that "Automatic Hotfix" was enabled and the fix is applied; look up the exact version in the vendor advisory. Treat any unpatched device as compromised until proven otherwise.
   • Rotate credentials: Change all local admin and user accounts on the appliance and every secret stored on it. That includes LDAP/AD bind accounts, RADIUS shared secrets, VPN PSKs and certificates, because SQL injection can dump the full configuration database.
   • Start replacement: CyberoamOS is a legacy product with expiring vendor support. Schedule migration to a supported platform (e.g. Sophos Firewall) as an emergency change, not a routine project.
   • Compromise check: If you see signs of compromise, isolate the appliance, preserve its configuration and logs, and rebuild from a known-good source. Do not blindly restore old configs. NIS2/KRITIS entities should assess reporting obligations (24 h early warning).
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Make management interfaces reachable only from a dedicated admin VLAN or an MFA-protected jump host. Add upstream ACLs that drop inbound internet traffic to the WebAdmin ports on the appliance IP.
   • IPS/WAF in front: If external reachability cannot be avoided, put an upstream IPS or reverse proxy with SQLi signatures in front of the appliance. Start from the Suricata ET "WEB_SPECIFIC_APPS" and SQL injection categories. Add a custom rule on http.uri/http.request_body matching UNION SELECT, ' OR 1=1, pg_sleep and ;-- towards the appliance IP.
   • Egress filtering for the appliance itself: Restrict outbound connections originating from the firewall to required destinations only (update servers, NTP, DNS, SIEM). Drop and log everything else to hinder payload staging and data exfiltration.
   • IAM/least privilege: Give the appliance's AD service accounts read-only rights and keep them out of privileged tiers (never Domain Admin). Keep local admin accounts to a minimum.
   • Configuration hardening: Disable the user portal and captive portal on WAN unless they are required. Enforce remote logging to an external syslog/SIEM so logs survive on-box tampering.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata): Alert on HTTP(S) requests from external sources to the appliance's WebAdmin ports. Where TLS is terminated at a proxy, inspect URI and body for SQL keywords. Example SPL: index=proxy dest_ip=<cyberoam_ip> (uri="*UNION*SELECT*" OR uri="*pg_sleep*" OR uri="*%27%20OR%20*")
   • Appliance logs (syslog in SIEM): Watch for new admin accounts, changes to firewall rules, NAT or device access, and admin logins from unknown IPs or outside maintenance windows. Sigma skeleton: logsource: product: cyberoam with selection: log_component|contains: 'Admin' and message|contains: ['user added','rule modified'].
   • Anomalous firewall egress: Hunt Zeek conn.log for connections sourced from the appliance's management or interface IPs to non-allowlisted destinations, especially HTTP downloads, unusual ports and long-lived sessions.
   • Follow-on activity internally: Correlate logons by the appliance service accounts outside normal LDAP binds (Windows Event ID 4624/4625 with LogonType 3/10 from the firewall IP, 4768/4769 for the bind account). Also watch for VPN logins with harvested credentials and lateral movement from the VPN pool.
   • Timing anomalies: Spikes in WebAdmin response latency or bursts of HTTP 500 responses suggest blind, time-based SQLi probing.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE), pwn.watch

Vendors and products

• Sophos

Weakness classes (CWE)

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  Base

  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

  Entry at MITRE CWE-89

References & sources

• cyberoam.comngfw.htmlx_refsource_MISC
• bleepingcomputer.comnews/security/sophos-fixes-sql-injection-vulnerability-in-their…x_refsource_MISC
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-29574government-resource
• pwn.watchpwn.watch: Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerabilitypwn-watch
• support.sophos.comSophos advisory: Sophos CyberoamOSpwn-watch
• NVD (NIST)NVD: CVE-2020-29574pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 15.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2020-29574","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2025-02-08T04:55:18.709307Z"}	{"id":"CVE-2020-29574","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2025-02-07T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0