Sophos · XG Firewall

CVE-2020-15069

Sophos XG Firewall Buffer Overflow Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 11%

What it is

Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.

CISA: Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 27, 2025

Added to the CISA list: February 6, 2025
Published: June 29, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 11% in the top 4.2% of all known vulnerabilities
Weakness: CWE-120
More details: NVD · CVE.org · CISA

All references (1)

https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal

More exploited flaws from Sophos

Added	Vulnerability	Product	Severity	Attack chance
Feb 6, 2025	(CROS) SQL InjectionCVE-2020-29574used by ransomware	CyberoamOS	Critical 9.8	4.7%
Nov 16, 2023	Command InjectionCVE-2023-1671	Web Appliance	Critical 9.8	>99.9%
Sep 23, 2022	Code InjectionCVE-2022-3236	Firewall	Critical 9.8	99%
Mar 31, 2022	Authentication BypassCVE-2022-1040	Firewall	Critical 9.8	99.8%
Mar 25, 2022	Remote Code ExecutionCVE-2020-25223	SG UTM	Critical 9.8	97%
Nov 3, 2021	SQL InjectionCVE-2020-12271used by ransomware	SFOS	Critical 10.0	42%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.