Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Sophos Releases Critical Advisory for Sophos Firewall

Critical vulnerabilities could lead to SQL injection, unauthorised access, or RCE 

Threat ID:
CC-4595
Threat Severity:
Medium
Published:
23 December 2024 2:22 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Critical vulnerabilities could lead to SQL injection, unauthorised access, or RCE 

Affected platforms

The following platforms are known to be affected:

Versions: v21.0 GA (21.0.0) and earlier

Sophos Firewall

Threat details

SSL-VPN and firewall appliances are popular targets for attackers

SSL-VPN and firewall appliances are internet-facing by design and are frequently targeted by attackers. Vulnerabilities in SSL-VPN and firewall appliances are often exploited soon after official disclosure so organisations are urged to apply security updates as soon as practicable.

Introduction

Sophos has released a critical advisory addressing two critical and one high severity vulnerability in its firewall product, simply known as Sophos Firewall. 

  • CVE-2024-12727 is a pre-authentication SQL injection vulnerability in the email protection feature which could allow an attacker to achieve remote code execution (RCE) and access to the reporting database. CVE-2024-12727 has a CVSSv3 score of 9.8 and affects firewalls with a specific configuration where Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability mode. 
  • CVE-2024-12728 is a weak credentials vulnerability with a CVSSv3 score of 9.8. The suggested and non-random Secure Shell (SSH) login passphrase for High Availability configuration remains active after initialisation, potentially exposing a high privileged system account. 
  • CVE-2024-12729 has a CVSSv3 score of 8.8 and is a code injection vulnerability in the User Portal. If exploited, an authenticated attacker could achieve RCE.

Remediation advice

Affected organisations are encouraged to review the Sophos advisory sophos-sa-20241219-sfos-rce and apply the relevant hotfixes as soon as is practicable.

Additional workarounds are described below.

Remediation steps

Type Step
Guidance

CVE-2024-12728

To mitigate the issue of the SSH passphrase (used during deployment of HA ports) remaining active, organisations are encouraged to ensure that:

  • SSH access is restricted to only the dedicated HA link that is physically separate
  • HA is reconfigured using a sufficiently long and random custom passphrase

Sophos recommends to disable WAN access via SSH and instead use VPN and/or Sophos Central for remote access and management.


https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
Guidance

CVE-2024-12729

  • Organisations can protect themselves from external attackers by ensuring their User Portal and Webadmin are not exposed to WAN.

https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce

Last edited: 23 December 2024 2:22 pm