CVE-2020-12271 Information

Description

A SQL injection issue was found in SFOS 17.0 17.1 17.5 and 18.0 before 2020-04-25 on Sophos XG Firewall devices as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s) portal admins and user accounts used for remote access (but not external Active Directory or LDAP passwords)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://community.sophos.com/kb/en-us/135412 https://news.sophos.com/en-us/2020/04/26/asnarok/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8