CVE-2020-12271
Sophos SFOS SQL Injection Vulnerability
Summary
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
Affected software
Vendor: Sophos · Product: SFOS
Weakness types (CWE):
What to do
This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.
Related vulnerabilities in Sophos
| CVE | Name | EPSS | Exploited |
|---|---|---|---|
| CVE-2023-1671 | Sophos Web Appliance Command Injection Vulnerability | 100.0% | Yes |
| CVE-2022-1040 | Sophos Firewall Authentication Bypass Vulnerability | 99.8% | Yes |
| CVE-2022-3236 | Sophos Firewall Code Injection Vulnerability | 98.9% | Yes |
| CVE-2020-25223 | Sophos SG UTM Remote Code Execution Vulnerability | 96.7% | Yes |
| CVE-2020-15069 | Sophos XG Firewall Buffer Overflow Vulnerability | 10.7% | Yes |
| CVE-2020-29574 | CyberoamOS (CROS) SQL Injection Vulnerability | 4.7% | Yes |
Is your domain exposed?
Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.
Get your free reportAll information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.