Exploited vulnerability · CISA KEV

Is CVE-2020-12271 exploited? Yes: in CISA KEV since 3 Nov 2021

Gociux · Sophos SFOS · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2020-12271, Sophos SFOS SQL Injection Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, 555 days after it was published. It is known to be used in ransomware campaigns. It affects Sophos SFOS. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

What to do

1. Check whether you run it. Look for SFOS in your asset inventory, including appliances and cloud images. Stack check lists every exploited Sophos CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 27 Apr 2020.
4. Get told next time. Email alerts when CISA adds a CVE for Sophos.

References

• nvd.nist.gov/vuln/detail/CVE-2020-12271

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in November 2021 · Sophos scorecard · act-now radar.