Sophos Sophos Firewall (XGS/SFOS) Vulnerabilities & Security Advisories
21 advisories tracked · Sophos ([email protected] CNA) via NVD · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Sophos advisory that VulniPulse classified as Sophos Firewall (XGS/SFOS), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 6 critical, 9 high, 5 medium, 1 low.
Android app · Google Play
Monitor Sophos CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Sophos ([email protected] CNA) via NVD
Sophos is its own CVE Numbering Authority. VulniPulse ingests Sophos's CVEs from the NVD CNA feed ([email protected]), each linking to its sophos.com advisory. Covers Sophos Firewall (XG/XGS, SFOS), Intercept X / Sophos Central endpoint, Sophos UTM, Sophos Mobile, Sophos Connect VPN and the Web/Email appliances — its firewalls are a repeated mass-exploitation target (the 'Pacific Rim' campaign), so an MSP-heavy, alert-hungry community.
Latest Sophos Sophos Firewall (XGS/SFOS) advisories
Medium [CVE-2024-13973] post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 (21.0.1) can potentially lead to administrators achieving arbitrary code execution.
Medium [CVE-2022-3711] Sophos Firewall: post-auth read-only SQL injection vulnerability
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.
Medium [CVE-2022-3709] Sophos Firewall: stored XSS vulnerability
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.
Medium [CVE-2021-25267] Sophos Firewall: Multiple XSS vulnerabilities in Webadmin
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.
Medium [CVE-2022-0331] Sophos Firewall: information disclosure vulnerability in Webadmin
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.