Actively exploited in the wild

Sophos XG Firewall Buffer Overflow Vulnerability

Sophos - XG Firewall · Listed in the CISA KEV since 2025-02-06. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2020-15069

CriticalCVSS 9.8KEV

Published: 29/06/2020(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.

Risk Assessment

An attacker can remotely execute arbitrary code on the Sophos XG Firewall, leading to full compromise of the edge device and potential breach of the entire network.

Recommendation

Immediately install hotfix HF062020.1 on all Sophos XG Firewalls running v17.x or update to a newer version.

Other vulnerabilities in Sophos XG Firewall

CVE-2020-12271CriticalActively exploited
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for local device admins, portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).

Original NVD description (English source)