Xg Firewall Firmware vulnerabilities

4 known vulnerabilities in Xg Firewall Firmware from Sophos. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Sophos Firewall: Improper Control of Generation of Code

  CVE-2022-3713Dec 1, 2022Sophos

  A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.

• 8.4 High severity

  Sophos Firewall: Improper Neutralization of Input During Web Page Generation

  CVE-2022-3709Dec 1, 2022Sophos

  A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.

• 7.2 High severity

  Sophos Firewall: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-3226Dec 1, 2022SophosEPSS 1.9%

  An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA.

• 9.8 Critical severity

  Sophos XG Firewall Buffer Overflow Exploited

  CVE-2020-15069Jun 29, 2020SophosEPSS 10.7%

  Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.