CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2020-15069

CVSS 9.8v3.1pub. 2020-06-29upd. 2025-11-07

Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sophos Xg Firewall

    HW
    Sophos
    all versions

  • Sophos Xg Firewall Firmware

    OS
    Sophos
    17.517.0 – 17.5 (excl.)

CISA KEV — detailsi

Vendori
Sophos
Producti
XG Firewall
Added to KEVi
February 6, 2025
Remediation deadline (US Federal)i
February 27, 2025(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 27 lutego 2025
Tags
RCEMemoryFirewall
CWE
References

Related vulnerabilities

CVE-2020-12271CRITICAL9.8⚠ KEVPL ✓same product

SQL Injection z RCE w Sophos XG Firewall — eksfiltracja danych

CVE-2020-15504CRITICAL9.8PL ✓same product

SQL injection umożliwiający RCE w Sophos XG Firewall

CVE-2020-11503CRITICAL9.8PL ✓same product

Heap-based buffer overflow w Sophos XG Firewall — potencjalny RCE

CVE-2022-3226HIGH7.2same product

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sopho...

CVE-2022-3696HIGH7.2same product

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases...