A malicious website could execute code remotely in Sophos Connect Client before version 2.1. View Analysis Description Severity CVSS. We also display any CVSS information provided within the CVE List from the CNA. Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. Issue: SFOS version: Security update distributed: NC-33639 (CVE-2018-16116) Version 17.0: July 17th, 2018, and SFOS v17.1 GA: Version 16.5 OEM: July 19th, 2018. The code erroneously suggests that the information handled is protected by utilizing the variable name 'escapedips' - however this was not the case. The Sophos ID is NSWA-1258. 29 CVE-2016-9038: 362: Mem. 2018-04-24: 2018-06-13. Sophos: List of all products, security vulnerabilities of products, cvss score reports, detailed graphical reports, vulnerabilities by years and metasploit modules related to products of this vendor. (e.g.: CVE-2009-1234 or 2010-1234 or 20101234). Sophos began pushing hotfixes to supported XG Firewalls: 2020-04-25 22:00: Sophos confirms completion of hotfix rollout to XG Firewall units with auto-update (default) enabled. More information This vulnerability is listed as CVE 2020-12271 in the National Vulnerability Database.

1. Sophos Exchange Cve
2. Advisory: Sophos XG Firewall Vulnerabilities Reported By ..

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Current Description

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)

Analysis Description

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)

Severity

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

Sophos Exchange Cve

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Advisory: Sophos XG Firewall Vulnerabilities Reported By ..