Sophos discloses critical Firewall remote code execution flaw

Share:

Sophos has addressed three vulnerabilities in its Sophos Firewall product that could allow remote unauthenticated threat actors to perform SQL injection, remote code execution, and gain privileged SSH access to devices.

The vulnerabilities affect Sophos Firewall version 21.0 GA (21.0.0) and older, with the company already releasing hotfixes that are installed by default and permanent fixes through new firmware updates.

The three flaws are summarized as follows:

  • CVE-2024-12727: A pre-authentication SQL injection vulnerability in the email protection feature. If a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with High Availability (HA) mode, it allows access to the reporting database, potentially leading to RCE.
  • CVE-2024-12728: The suggested, non-random SSH login passphrase for HA cluster initialization remains active after the process completes, leaving systems where SSH is enabled vulnerable to unauthorized access due to predictable credentials.
  • CVE-2024-12729: An authenticated user can exploit a code injection vulnerability in the User Portal. This allows attackers with valid credentials to execute arbitrary code remotely, increasing the risk of privilege escalation or further exploitation.

The company says CVE-2024-12727 impacts approximately 0.05% of firewall devices with the specific configuration required for exploitation. As for CVE-2024-12728, the vendor says it impacts approximately 0.5% of devices.

Available fixes

Hotfixes and complete fixes were made available through various versions and dates, as follows:

Hotfixes for CVE-2024-12727 are available since December 17 for versions 21 GA, v20 GA, v20 MR1, v20 MR2, v20 MR3, v19.5 MR3, v19.5 MR4, v19.0 MR2, while a permanent fix was introduced in v21 MR1 and newer.

Hotfixes for CVE-2024-12728 were released between November 26 and 27 for v21 GA, v20 GA, v20 MR1, v19.5 GA, v19.5 MR1, v19.5 MR2, v19.5 MR3, v19.5 MR4, v19.0 MR2, and v20 MR2, while permanent fixes are included in v20 MR3, v21 MR1 and newer.

For CVE-2024-12729, hotfixes were released between December 4 and 10 for versions v21 GA, v20 GA, v20 MR1, v20 MR2, v19.5 GA, v19.5 MR1, v19.5 MR2, v19.5 MR3, v19.5 MR4, v19.0 MR2, v19.0 MR3, and v20 MR3, and a permanent fix is available in v21 MR1 and later.

Sophos Firewall hotfixes are installed by default, but you can find instructions on how to apply them and validate that they were successfully installed by referring to KBA-000010084.

Sophos has also proposed workarounds for mitigating risks associated with CVE-2024-12728 and CVE-2024-12729 for those who cannot apply the hotfix or upgrade.

To mitigate CVE-2024-12728, it is recommended to limit SSH access only to the dedicated HA link that is physically separated from other network traffic and reconfigure the HA setup using a sufficiently long and random custom passphrase.

For remote management and access, disabling SSH over the WAN interface and using Sophos Central or a VPN is generally recommended.

To mitigate CVE-2024-12729, it is recommended that admins ensure the User Portal and Webadmin interfaces are not exposed to the WAN.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
8:19 pm, Feb 6, 2025
weather icon 5°C
L: 5° | H: 6°
scattered clouds
Humidity: 82 %
Pressure: 1039 mb
Wind: 10 mph NE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 40%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 7:30 am
Sunset: 4:58 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
5° | 6°°C 0 mm 0% 12 mph 82 % 1038 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
3° | 5°°C 1 mm 100% 13 mph 96 % 1037 mb 0 mm/h
Sat Feb 08 9:00 pm
weather icon
4° | 6°°C 1 mm 100% 12 mph 95 % 1027 mb 0 mm/h
Sun Feb 09 9:00 pm
weather icon
5° | 8°°C 0 mm 0% 11 mph 95 % 1037 mb 0 mm/h
Mon Feb 10 9:00 pm
weather icon
3° | 5°°C 0.2 mm 20% 11 mph 94 % 1036 mb 0 mm/h
Today 9:00 pm
weather icon
4° | 5°°C 0 mm 0% 12 mph 82 % 1038 mb 0 mm/h
Tomorrow 12:00 am
weather icon
4° | 5°°C 0 mm 0% 12 mph 81 % 1037 mb 0 mm/h
Tomorrow 3:00 am
weather icon
3° | 4°°C 0 mm 0% 11 mph 82 % 1035 mb 0 mm/h
Tomorrow 6:00 am
weather icon
4° | 4°°C 0 mm 0% 12 mph 77 % 1030 mb 0 mm/h
Tomorrow 9:00 am
weather icon
4° | 4°°C 0 mm 0% 13 mph 74 % 1028 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
3° | 3°°C 0.89 mm 89% 12 mph 91 % 1025 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
4° | 4°°C 1 mm 100% 13 mph 91 % 1022 mb 0 mm/h
Tomorrow 6:00 pm
weather icon
3° | 3°°C 1 mm 100% 10 mph 89 % 1020 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,933.67
-1.48%
Ethereum(ETH)
€2,607.96
-2.82%
Tether(USDT)
€0.97
-0.02%
XRP(XRP)
€2.24
-5.56%
Solana(SOL)
€184.23
-4.57%
USDC(USDC)
€0.97
-0.01%
Dogecoin(DOGE)
€0.237742
-5.19%
Shiba Inu(SHIB)
€0.000014
-6.34%
Pepe(PEPE)
€0.000009
-7.58%
Scroll to Top