CyberoamOS (CROS) SQL Injection Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 11, 2020 · Catalog

   Detected

   An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

2. Feb 6, 2025 · CISA KEV

   Known exploited

   The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

3. Feb 27, 2025 · CISA KEV

   Remediation due

   The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

4. Aug 14, 2026 · Catalog

   Updated

   An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

Affected

• cpe sophos/cyberoamosversion unspecified
• vendor Sophos CyberoamOSversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2020-29574

  CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

  cisa.gov
• CVE.orgVulnerability recordCVE-2020-29574

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2020-29574

  30-day exploitation probability 4.7%

  first.org
• NIST NVDVulnerability recordCVE-2020-29574

  An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · support.sophos.com
• Third Party Advisory · bleepingcomputer.com
• US Government Resource · cisa.gov
• Product · cyberoam.com