critical9.8Known exploited
CVE-2020-15069
Sophos XG Firewall Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-02-06. Federal due date: 2025-02-27.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sophos | Xg Firewall Firmware | from 17.0 before 17.5 Version 17.5 |