2024-120: Critical Vulnerabilities in Sophos Firewall

2024-120: Critical Vulnerabilities in Sophos Firewall ↗ source

December 20, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-120/

Summary

These flaws could allow attackers to escalate privileges or The vulnerability CVE-2024-12727, with a CVSS score of 9.8, is a pre-auth SQL injection vulnerability in the email protection feature allowing access to the reporting database of Sophos Firewall. If exploited, this vulnerability could lead to remote code execution on the affected device. This vulnerability affects devices with a specific configuration where Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode. The vulnerability CVE-2024-12728, with a CVSS score of 9.8, is due to the suggested and nonrandom SSH login passphrase for High Availability (HA) cluster initialisation remaining active after the HA establishment process is completed. If exploited, this vulnerability could expose a privileged system account on the Sophos Firewall if SSH is enabled.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-12727	9.8 Critical	Sophos Sophos Firewall A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the …
CVE-2024-12728	9.8 Critical	Sophos Sophos Firewall A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
CVE-2024-12729	8.8 High	Sophos Sophos Firewall A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Sophos 7 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.