DaystoPatch

SophosExploited incident

CyberoamOS WebAdmin SQL injection (2020), used to create rogue accounts

CVE-2020-29574Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 6 Feb 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqliCuratedQuote verified

    On some systems, this may have been used to create an unrecognized account.

    Advisory header 'First Published 2020 Dec 10'. The hotfix rollout began 2020-12-04 without, as far as found, a public advisory; no earlier public exploitation report was found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9c833b7debe4506…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2020-29574ClaimedQuote verified11 Dec 2020, 16:03 UTC

    An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c99811c2a0ccf92b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2020-29574)ClaimedQuote verified6 Feb 2025

    CyberoamOS (CROS) SQL Injection Vulnerability

    Added to CISA's KEV catalog on 2025-02-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet7 Feb 2025, 21:01 UTC

    CVE-2020-29574 has confirmed exploit code according to the following sources: CISA KEV, Vulncheck KEV.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqliCuratedQuote verified

    sophos-sa-20201210-cyberoam-webadmin-sqli

    Publication ID encodes the date; header shows 'First Published 2020 Dec 10'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9c833b7debe4506…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqliCuratedQuote verified

    Hotfix distributed to all supported Cyberoam OS devices starting December 4, 2020

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9c833b7debe4506…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Sophos security advisory sophos-sa-20201210-cyberoam-webadmin-sqliCuratedQuote verified

    Hotfix also distributed to unsupported EOL Cyberoam versions 10.6.2 and later

    Rollout to all supported devices started 2020-12-04; the date the EOL builds received it is not stated, so patch_all uses the start of the rollout for supported versions.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c9c833b7debe4506…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

CyberoamOS WebAdmin SQL injection zero-day (2020), fixed by hotfix from Dec 4

Attackers used an SQL injection in the Cyberoam OS WebAdmin to create an unauthorised administrator account in November 2020, before Sophos began pushing a hotfix on 4 December 2020.

In plain words

Old Cyberoam firewalls, a product line Sophos has retired, had a flaw that attackers used in late November 2020 to add an unauthorised administrator account. Sophos pushed a fix from 4 December 2020. If we still have any Cyberoam devices, they should be replaced and checked for unknown administrator accounts.

What happened and who is affected

What happened

CVE-2020-29574 is an SQL injection in the WebAdmin interface of Cyberoam OS, an end-of-life Sophos product line. Sophos's 2024 'Pacific Rim' report says attackers used it from 27 November 2020 to create an administrator account named 'cybersupport'. Sophos distributed a hotfix to supported devices from 4 December 2020, also to end-of-life versions 10.6.2 and later, and published its advisory on 10 December 2020. CISA added it to its exploited-vulnerabilities catalog in February 2025.

Who is affected

All Cyberoam OS devices; the hotfix covers supported versions and end-of-life versions 10.6.2 and later.

CVE-2020-29574. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/sophos-cve-2020-29574/

Affected products

  • Cyberoam OS devices
How we built this timeline

Old incident included because CISA added it to KEV on 6 Feb 2025 (ransomware use Known). Cyberoam OS was end of life by 2020;

Sophos recommends moving to XG Firewall v17.5 or later. The 2020 advisory says the flaw 'may have been used to create an unrecognized account' without saying when;

Sophos's 2024 Pacific Rim timeline dates the attack (see below). The advisory header says 'Workaround No' (it recommends keeping WebAdmin and SSH off the WAN).

The KEV-referenced KBA-000007526 page is JavaScript-heavy; the sophos.com advisory is cited. CVSS 9.8 per NVD. end_of_life is deliberately false despite the KEV wording ('The impacted product is end-of-life (EoL) and/or end-of-service (EoS).

Users should discontinue utilization of the product.'): the flag means the vendor will not ship a fix, but Sophos did ship one ('Hotfix distributed to all supported Cyberoam OS devices starting December 4, 2020' and 'Hotfix also distributed to unsupported EOL Cyberoam versions 10.6.2 and later'), so the incident keeps normal exposure scoring. Correction 23 Oct 2026 (audit 2, R4 post-mortem rule): exploited before a fix changed from false to true.

Sophos's 'Pacific Rim' timeline (news.sophos.com, 31 Oct 2024, https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/) says under 'November 27, 2020: Lower-hanging fruit': 'The attacker used a zero-day which would later become CVE-2020-29574 to create a new administrator-level user account, named “cybersupport,” on impacted devices (T1136.001).' The hotfix rollout began 4 Dec 2020, so exploitation predates the fix.

Related

No related incidents.

Sophos report card