Sophos Firewall Flaws: From SQL Chaos to SSH Shenanigans!
Sophos Firewall had a bit of a security oopsie with SQL injection and remote code execution vulnerabilities, but they’ve patched things up with hotfixes. A small percentage of devices are affected, so unless your firewall is part of the 0.05% club, you can continue browsing cat videos in peace.
Hot Take:
Oh, Sophos! Looks like your firewalls need a firewall of their own! If vulnerabilities were a sport, Sophos would be going for the gold with three major blunders in their firewall product. Let’s hope their fix game is as strong as their vulnerability game.
Key Points:
- Sophos Firewall had three vulnerabilities: SQL injection, remote code execution, and SSH access issues.
- Vulnerabilities affect version 21.0 GA and older, with hotfixes and permanent fixes released.
- CVE-2024-12727 impacts about 0.05% of devices, and CVE-2024-12728 impacts about 0.5% of systems.
- Hotfixes and fixes for the vulnerabilities were released on varying dates for different versions.
- Workarounds are proposed for those unable to apply fixes, involving configuration adjustments and disabling certain features.
Already a member? Log in here