Executive brief
Sophos XG Firewall contains a classic buffer overflow vulnerability in the HTTP/S Bookmarks feature for clientless access. This flaw allows unauthenticated remote attackers to execute arbitrary code on the device.
Affected products
- Sophos XG Firewall Firmware 17.x through 17.5 MR12
Timeline
- 2020-06-29: disclosed: NVD Published Date
- 2020-06-29: patched: Hotfix HF062020.1 released for v17.x
- 2025-02-06: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-02-06: exploited: Reported as exploited in the wild per CISA KEV entry