Threat intelligence / Vulnerability

CVE-2020-12271

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Vulnerability

TypeVulnerability

External ID—

First seen2021-11-03

Last seen2021-11-03

Confidence

—

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Labels

exploitedkevransomware

CISA KEV context

Vendor / productSophos SFOS

Added2021-11-03

Due date2022-05-03

7 recorded

Relationships

mitigates

from Remediate CVE-2020-12271

Mitigation

related-to

to Blind SQL Injection

Technique

related-to

to Command Line Execution through SQL Injection

Technique

related-to

to Expanding Control over the Operating System from the Database

Technique

related-to

to Object Relational Mapping Injection

Technique

related-to

to SQL Injection

Technique

related-to

to SQL Injection through SOAP Parameter Tampering

Technique

2 external

References

nvd

CVE-2020-12271

cwe

CWE-89