A critical business logic vulnerability in Sophos Firewall allows unauthenticated remote code execution, posing a severe risk to network security.

The vulnerability resides in the Up2Date component, which fails to properly validate inputs during security decisions (CWE-807). This allows an unauthenticated, remote attacker to control the firewall DNS environment and execute arbitrary code.

The ability for an unauthenticated attacker to achieve remote code execution on a firewall is catastrophic, as it grants full control over the perimeter security gateway. Given the CVSS score of 8.1, this vulnerability presents a high risk of data exfiltration, lateral movement, and total compromise of the internal network.

Immediate Action: Update Sophos Firewall to version 21.0 MR1 (21.0.1) or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor firewall logs for unauthorized DNS configuration changes or anomalous traffic patterns originating from the Up2Date service.

Compensating Controls: Ensure the firewall management interface is not exposed to the public internet and restrict access to authorized management subnets only.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the integrity of the network perimeter. Administrators must prioritize upgrading their Sophos Firewall instances to the identified fixed version as soon as possible to neutralize the possibility of remote code execution.