High WID-SEC-2024-3735 3 CVEs

Sophos Firewall: Mehrere Schwachstellen

Published Dec 19, 2024 · Updated Dec 19, 2024 · de-DE

Vendor: Sophos Product: Firewall

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in der Sophos Firewall ausnutzen, um beliebigen Code auszuführen oder seine Privilegien zu erhöhen.

Product

Sophos Firewall ist die Firewall-Software für Sophos Appliances.

Vulnerabilities 3

Critical 9.8

CVE-2024-12727

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 …

Sophos Sophos Firewall Network devices

Dec 19, 2024
Critical 9.8

CVE-2024-12728

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than vers…

Sophos Sophos Firewall Network devices

Dec 19, 2024
High 8.8

CVE-2024-12729

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Soph…

Sophos Sophos Firewall Network devices

Dec 19, 2024

Revision history

2024-12-19 #1
Initiale Fassung

References

Sophos Security Advisory sophos-sa-20241219-sfos-rce vom 2024-12-19
https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
GitHub Database
https://github.com/advisories/GHSA-wj5c-255p-6pwh
GitHub Database
https://github.com/advisories/GHSA-6r4g-xxf8-49wf
GitHub Database
https://github.com/advisories/GHSA-vf9g-3qff-2rx6