Paper/Archive/CVE-2024-12727

CVE-2024-12727

Sophos Sophos Firewall — A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows ac…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 72.5.725 × 2014.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.

Affected

ProductAffectedFixed inSource

Sophos Firewall< 21.0 MR1 (21.0.1)21.0 MR1 (21.0.1)CNA

Scores by source

Sophos (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce