Sophos Firewall Vulnerabilities Could Allow Remote Attacks

Sophos users should ensure that their firewall devices are updated with the latest updates to address several security vulnerabilities. These vulnerabilities could be exploited for various malicious actions, including code execution attacks.

Multiple Vulnerabilities Patched In Sophos Firewall

According to a recent advisory, Sophos has patched at least three vulnerabilities in the Sophos Firewall. These vulnerabilities include:

• CVE-2024-12727 (critical severity; CVSS 9.8): an SQL injection vulnerability affecting the email protection feature. This vulnerability could allow an attacker to gain access to the target Firewall’s reporting database and execute remote code execution attacks.
• CVE-2024-12728 (critical severity; CVSS 9.8): This vulnerability was due to weak credentials, enabling an attacker to gain elevated privileges via SSH on the target Sophos Firewall.
• CVE-2024-12729 (high severity; CVSS 8.8): A post-auth code injection vulnerability in the User Portal, allowing an authenticated attacker to execute code on the target device.

Two of these vulnerabilities were reported by external security researchers through Sophos’ bug bounty program, while the third was discovered internally by Sophos researchers.

These vulnerabilities affected Sophos Firewall v21.0 GA (21.0.0) and older versions. Sophos has released patches for all vulnerabilities, initially as hotfixes and later integrated into v20 MR3, v21 MR1, and newer versions. Users are advised to check for updates with stable releases to ensure the security of their systems.

In addition to patching the vulnerabilities, Sophos has shared mitigation strategies for devices where immediate patching is not possible. These strategies include securing SSH access and disabling WAN access to User Portal and WebAdmin.

Sophos has confirmed that there have been no active exploits of these vulnerabilities. However, users are urged to update their devices promptly to protect against potential threats.

Share your thoughts in the comments section below.