Sophos Firewall Fiasco: Critical Vulnerabilities and the Race to Patch Up!
Sophos has patched a critical firewall vulnerability, CVE-2024-12727, potentially allowing remote code execution by attackers. With a CVSS score of 9.8, this SQL injection bug affects only 0.05% of devices. Sophos recommends updating to Firewall version 21.0 MR1 and advises security measures to prevent exploitation. Stay patched, stay safe!
Hot Take:
Looks like Sophos firewalls were having a little too much fun being wide open! Who knew they’d be such social butterflies, allowing just anyone to drop by and execute arbitrary code? But hey, at least only a tiny fraction of their friends, er, devices, were affected. Time to patch up those social faux pas and make sure they don’t crash the wrong parties again!
Key Points:
- A critical vulnerability in Sophos firewall products, CVE-2024-12727, has been patched.
- The SQL injection bug could allow remote code execution without authentication.
- Only 0.05% of devices are affected by the flaw.
- Additional vulnerabilities, CVE-2024-12728 and CVE-2024-12729, were also addressed.
- Sophos advises restrictions on SSH and WAN access for mitigation.
Already a member? Log in here