CVE-2020-12271criticalunder attackransomwareCWE-89

CVE-2020-12271

Published · Updated

Follow this CVE+ Monitor SFOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 10epss 42%
from disclosure to weapon
Published on NVDApr 27
CISA KEV+555d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A SQL injection vulnerability in Sophos XG Firewall allowed attackers to execute arbitrary code and steal administrative credentials through the exposed web administration or user portal interfaces.

Technical detail

SQL injection vulnerability (CWE-89) in SFOS versions 17.0, 17.1, 17.5, and 18.0 (before 2020-04-25) exploitable via HTTPS administration service or User Portal exposed to WAN. Successful exploitation enables remote code execution and credential exfiltration of local admin, portal admin, and remote access user account hashes.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Affected products
n/a · n/a