CVE-2024-12728

The vulnerability classified as CWE-1391 (use of weak credentials) means that Sophos Firewall in versions earlier than 20.0 MR3 possesses predictable or default login credentials for the SSH service. A remote attacker, without any prior authentication, can exploit these weak credentials to log in via SSH. Upon successful authentication, they gain privileged access to the operating system of the device.

An attacker can gain full, privileged access to the Sophos Firewall system, enabling them to read sensitive configuration, modify firewall rules, take control of the network device, and potentially perform further lateral movement within the infrastructure protected by the device.

Update Sophos Firewall to version 20.0 MR3 (20.0.3) or newer. As a temporary workaround, it is recommended to restrict SSH access to the device exclusively to trusted IP addresses and change default credentials. Details are available in the vendor advisories: https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce

Sophos Firewall Firmware and Sophos Firewall in versions earlier than 20.0 MR3 (20.0.3)