HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2020-17352

CVSS 8.8v3.1pub. 2020-08-07upd. 2024-11-21

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Sophos Xg Firewall Firmware

    OS
    Sophos
    17.518.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEFirewallCommand Injection
CWE
References

Related vulnerabilities

CVE-2020-15069CRITICAL9.8⚠ KEVPL ✓same product

Buffer Overflow w Sophos XG Firewall umożliwiający zdalne wykonanie kodu

CVE-2020-15504CRITICAL9.8PL ✓same product

SQL injection umożliwiający RCE w Sophos XG Firewall

CVE-2022-3696HIGH7.2same product

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases...

CVE-2022-3713HIGH8.8same product

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Fire...

CVE-2022-3226HIGH7.2same product

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sopho...