Critical severity · published Apr 27, 2020
CVE-2020-12271
Sophos SFOS SQL Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
42.4%
EPSS
Yes
On KEV
Description
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)42.4% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useKnown
Affected products
Which versions
FI
Firewall · Sophos
17.0; 17.1; 17.5; 18.0 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12271
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12271
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://cwe.mitre.org/data/definitions/89.html
x_refsource_MISC
https://community.sophos.com/kb/en-us/135412
x_refsource_MISC
https://news.sophos.com/en-us/2020/04/26/asnarok/
More from Firewall
9.8
CVE-2022-3236
Sophos Firewall Code Injection Vulnerability
9.8
CVE-2022-1040
Sophos Firewall Authentication Bypass Vulnerability
9.8
CVE-2024-12728
A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3)
9.8
CVE-2024-12727
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can…
9.8
CVE-2020-11503
A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely