Overview

Sophos Firewalls are vulnerable to critical vulnerabilities. A remote attacker can exploit these vulnerabilities to execute arbitrary code.

Description

Sophos Firewalls are affected by critical vulnerabilities tracked as CVE-2024-12727, and CVE-2024-12728 with CVSS base score of 9.8 each. The vulnerabilities result from pre-auth SQL injection vulnerability in the email protection feature and failure to deactivate High Availability (HA) cluster initialization after the HA establishment process is completed. The attacker can exploit these vulnerabilities by sending a specially crafted request to execute arbitrary code on the affected system.

Impact

Successful exploitation of these vulnerabilities may allow the attacker to take control of the affected system.

Solution

Sophos has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.

References

• 1. https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce