CVE-2020-29574: CyberoamOS (CROS) SQL Injection Vulnerability

CVE-2020-29574 is a SQL injection flaw in the WebAdmin interface of Sophos CyberoamOS (also called CROS). An unauthenticated attacker can send crafted input that causes the system to run arbitrary SQL statements remotely. Because the product is end-of-life and end-of-service, continued use leaves organizations without vendor fixes and with a remotely reachable administrative surface that can be abused to read or alter data, escalate privileges, or disrupt operations.

IT and security teams should treat any remaining CyberoamOS deployments as high priority for discovery and removal. Confirm all technical details against the original vendor advisory and CISA guidance before acting.

How it works

The vulnerability belongs to CWE-89 (SQL injection). In this class of flaw, user-controlled input reaches a database query without proper sanitization or parameterization. An attacker who can reach the WebAdmin interface can inject SQL fragments that the application executes with the privileges of the backend database account.

According to the CISA summary, the injection point is in CyberoamOS WebAdmin and requires no authentication. Successful abuse lets the attacker execute arbitrary SQL statements. Typical outcomes for this weakness include dumping credentials or configuration data, modifying firewall or user records, or creating new administrative accounts. Exact request formats, parameters, or payloads are not provided here; teams must obtain those details only from the vendor advisory if they are still available.

Am I affected? How to find it in your systems

CyberoamOS historically ran on Sophos Cyberoam network security appliances that provided firewall, VPN, and web-filtering functions. These devices commonly sit at network perimeters or in branch offices and expose a web-based management console.

• Inventory every appliance still labeled Cyberoam or running CyberoamOS/CROS firmware. Check asset-management databases, network-management systems, and DHCP/ARP tables for residual devices.
• Scan internal and external address space for open WebAdmin ports (commonly HTTPS management interfaces) and identify the product banner or login page.
• Because the product is end-of-life, any live instance is considered affected; version numbers are not supplied in the available facts, so treat presence of the software itself as the indicator.
• Review authentication and web-server logs for unexpected SQL syntax, long or encoded query strings, or unauthenticated requests that return database errors. Absence of such logs does not prove safety; the product may not log injection attempts by default.

Confirm exact management ports and identification strings against any remaining vendor documentation.

How to remediate

CISA’s required action is unambiguous: the product is end-of-life and/or end-of-service, so organizations must discontinue utilization. There is no supported patch path.

• Plan and execute replacement with a currently supported firewall or UTM platform.
• Migrate rules, VPN configurations, and user directories before decommissioning.
• Power off and remove the CyberoamOS appliances from the network once migration is complete; wipe or securely dispose of the hardware according to organizational media-sanitization policy.
• Update network diagrams, monitoring, and change-control records to reflect the removal.

If any residual configuration data must be retained for audit, export it offline before the devices are retired.

If you can't patch immediately

Because the product is unsupported, “patching later” is not a viable strategy. Until the devices can be replaced, apply compensating controls that shrink the attack surface:

• Isolate the appliances on a dedicated management VLAN reachable only from a jump host or bastion that itself requires multi-factor authentication.
• Block all inbound access to the WebAdmin interface from untrusted networks, including the internet, via upstream ACLs or firewall rules.
• If a web application firewall or reverse proxy sits in front of the management interface, enable SQL-injection signatures and strict request validation as a temporary virtual patch; tune carefully to avoid blocking legitimate administration.
• Disable remote management entirely if local console access is sufficient for the remaining life of the device.
• Increase logging and forward WebAdmin and system logs to a SIEM; alert on any unauthenticated access attempts or anomalous SQL-like strings.
• Monitor for lateral movement originating from the CyberoamOS host, because a successful SQL injection could be used as a foothold.

These measures only reduce risk; they do not eliminate the underlying vulnerability. Schedule decommissioning as soon as operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to credential theft, configuration compromise, or broader network intrusion. Known ransomware use of this specific CVE is not documented, yet the remote, unauthenticated nature of the flaw still warrants investigation. Review logs for signs of successful SQL injection, check for unexpected administrative accounts or rule changes, and rotate any credentials that may have been stored on or accessible through the appliance. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts have already appeared in public dumps.