Is CVE-2020-29574 (CyberoamOS (CROS) SQL Injection) being exploited in the wild?

Yes. CISA added CVE-2020-29574 to its Known Exploited Vulnerabilities catalogue on 6 February 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.

What the KEV listing means for real-world exploitation

CISA’s Known Exploited Vulnerabilities catalogue is a practical signal, not a theoretical one. When a CVE appears there, the issue is no longer just a code flaw in a product, it is an active exposure that defenders should treat as being on the attacker’s shortlist. For a web-admin SQL injection in an internet-facing appliance, that usually means exposure can be weaponised quickly and repeatedly.

An important detail here is the attack surface itself. Management interfaces, especially on perimeter or edge devices, are often reachable from many places and are operationally sensitive because they sit near trust boundaries. That makes a remotely reachable SQL injection more dangerous than an equivalent flaw buried inside an internal-only application, because exploitation can begin before an attacker has any other foothold.

How this kind of SQL injection becomes operationally dangerous

SQL injection in a web administration interface is not only an application defect, it is a control-plane issue. If an unauthenticated attacker can submit arbitrary SQL, they may be able to read, modify, or delete backend data, alter administrative state, or create a foothold for follow-on actions. On appliances, the boundary between application logic and privileged backend access is often thin, so impact can extend beyond a single query.

This is why SQL injection in admin interfaces is frequently paired with broader compromise activity. Once the attacker can influence the database layer, they may be able to extract configuration data, discover credentials, tamper with security settings, or establish persistence. For a device that mediates network traffic or administration access, that can become an infrastructure compromise rather than a simple data issue.

What defenders should do while exposure is being confirmed

Confirm whether the affected product is deployed, whether the vulnerable management interface is reachable, and whether it is exposed beyond the smallest necessary administrative network. If the appliance is Internet-facing or reachable from user networks, treat it as higher priority than a comparable internal-only deployment.

Where a fix or vendor mitigation is available, apply it first to externally exposed instances and then to the remaining estate. If patching must wait, reduce reachability immediately by tightening network access, limiting administrative paths, and disabling unnecessary management exposure. For appliances that cannot be easily inspected, use the vendor advisory and the CISA KEV catalogue to align remediation timing with authoritative guidance.

For defenders who need a broader remediation workflow, Zero-Day and Exploited Vulnerabilities Guide explains the triage logic that matters when exploitation is already happening, while SQL Injection Prevention Guide covers the defensive patterns that prevent this class of flaw from recurring in exposed admin surfaces.

Risk and Threat Considerations

Because this CVE affects a management-facing interface on an edge product, the main risk is not just data exposure, it is appliance compromise with broad downstream reach. In practice, that can mean attacker control over trusted infrastructure, stealthy tampering, or a launch point for lateral movement if the appliance stores sensitive configuration or credentials.

Failure mechanism: An unauthenticated SQL injection lets an attacker issue arbitrary database statements through a web-admin path that defenders may assume is protected by its administrative role.

Impact: The attacker may gain direct influence over administrative data, sensitive configuration, or stored secrets, and in a perimeter device that can translate into persistence, service disruption, or wider network compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Exposed appliance management surfaces need hardened configuration and reachability limits.
	CIS-7 — Continuous Vulnerability Management	A KEV-listed CVE requires prioritized identification and remediation of affected assets.
Recommendation — Harden appliance management exposure and disable unnecessary remote admin access. Prioritise, track, and remediate KEV-listed vulnerable appliances first.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is an exploitable software flaw requiring timely remediation and mitigation.
	AC-17 — Remote Access	The vulnerable interface is a remotely reachable admin path that should be tightly controlled.
Recommendation — Apply timely flaw remediation and compensating mitigations for exposed systems. Restrict remote administrative access to trusted, least-privilege pathways only.
OWASP ASVS	V8 — Authorization	SQL injection in admin flows often breaks intended access boundaries around privileged actions.
Recommendation — Verify privileged functions cannot be reached through user-controlled database input.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	A remotely reachable web-admin SQL injection fits public-facing exploitation behavior.
Recommendation — Hunt for exploitation attempts against internet-facing management interfaces.

Practitioner Guidance

What to prioritise: Treat exposed administrative interfaces on security appliances as the highest-value validation target. If the device is reachable from outside a restricted admin segment, assume the blast radius is larger and move it ahead of lower-exposure internal issues.

What to verify: Check for signs of compromise before and after remediation, especially unexpected admin changes, unfamiliar database activity, new local users, altered network policy, or unusual outbound connections from the appliance. If the device stored or processed credentials, rotate any secrets that may have been exposed through the management path.

Practitioner takeaway: For KEV-listed appliance flaws, the question is not whether exploitation is possible, it is whether the exposed management path has already been reduced enough to keep a known exploit from becoming an infrastructure event.