Exploited vulnerability

CVE-2020-12271

TLP:CLEAR

Sophos SFOS SQL Injection Vulnerability

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Facts

Vendor: Sophos
Product: SFOS
CVSS: 9.8
EPSS (probability of exploitation within 30 days): 42.4 %
On CISA's Known Exploited Vulnerabilities list since: 3 November 2021
First known exploitation: 3 November 2021
Used in ransomware campaigns (per CISA): Yes
CISA's deadline for US federal agencies: 3 May 2022
Weakness: CWE-89
First seen by Risk Letters: 3 November 2021

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD