CVE DatabaseCVE-2020-12271

Updated 2026-06-17한국어 권고문 →

CVE-2020-122719.8/CRITICALCISA KEVCWE-89CWE-89

Sophos XG Firewall SQL Injection and Remote Code Execution Vulnerability (CVE-2020-12271) Critical Security Advisory

⚡ Jump to Patch

Affected Vendors

sophos

Affected Components

xg_firewall, sfos

Published Date

2020-04-27

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

43.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Sophos XG Firewall devices running SFOS versions 17.0, 17.1, 17.5, and 18.0 before 2020-04-25, with administration (HTTPS) or User Portal exposed on the WAN zone.

Impact

Unauthenticated remote attackers can execute arbitrary code via SQL injection, leading to the exfiltration of usernames and hashed passwords of local administrators and portal users.

Mitigation

Immediately apply the official firmware patches and disable WAN-side access to the administration interface and User Portal.

Affected Products & Version Scope

Sophos XG Firewall SFOS versions 17.0, 17.1, 17.5, and 18.0 prior to the 2020-04-25 hotfix, specifically when configured with HTTPS administration or User Portal exposed to the WAN zone.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Sophos has released hotfixes and updated firmware versions to address this vulnerability. If automatic updates are disabled, verify your current version and apply the latest firmware via the CLI:

bash

# Check current SFOS version details
system diagnostics show version-info

# Check and download available firmware updates
system package-update check
system package-update download

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict WAN access to the administration and User Portal interfaces to mitigate the attack vector.

bash

# Disable HTTPS Admin and User Portal access from the WAN zone
console> system appliance_access show
console> system appliance_access set HTTPS wanzone disable
console> system appliance_access set UserPortal wanzone disable

3. Log Audit & IoC Verification Commands

Inspect system and database logs for indicators of compromise (IoCs), such as anomalous SQL queries or unauthorized administrative sessions.

bash

# Search PostgreSQL logs for common SQL injection patterns
grep -i 'select' /var/tslog/postgres.log | grep -E '(union|concat|char|pg_sleep)'

# Audit administrative login attempts and session logs
tail -n 500 /var/tslog/csc.log | grep -i 'login'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Immediately disable WAN-facing management interfaces on Sophos XG Firewalls and verify that the latest security hotfixes are applied.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-12271) is a critical SQL injection (CWE-89) flaw residing in Sophos Firewall OS (SFOS) on Sophos XG Firewall devices. The root cause is the insufficient sanitization of user-supplied input directed to the administration (HTTPS) service or the User Portal when exposed to the WAN zone.

2. Exploitation Mechanics & Attack Scenario

In April 2020, this vulnerability was actively exploited in the wild under a campaign known as 'Asnarok'. Attackers sent specially crafted SQL payloads to the exposed login interfaces on the WAN zone. These payloads manipulated the backend database queries, allowing the attackers to bypass authentication and leverage database functions to write malicious files or execute system commands, achieving remote code execution (RCE).

3. Infrastructure & Business Impact

Successful exploitation grants the attacker full administrative control over the firewall appliance. This allows the exfiltration of sensitive credentials, including usernames and hashed passwords for local device administrators, portal administrators, and VPN user accounts. While external Active Directory or LDAP passwords are not affected, the compromise of local credentials poses a severe risk of lateral movement into the internal network.

Official Vendor Advisories & References

NVD Original English Description

A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)

https://community.sophos.com/kb/en-us/135412

Source: cve@mitre.org · Vendor Advisory

https://cwe.mitre.org/data/definitions/89.html

Source: cve@mitre.org · Third Party Advisory

https://news.sophos.com/en-us/2020/04/26/asnarok/

Source: cve@mitre.org · Exploit, Vendor Advisory

https://community.sophos.com/kb/en-us/135412

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://cwe.mitre.org/data/definitions/89.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory

https://news.sophos.com/en-us/2020/04/26/asnarok/

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2020-12271)

FAQ

Q1. How critical is CVE-2020-12271 and is it actively exploited in the wild?

CVE-2020-12271 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 43.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-12271?

Primary impacted vendors include sophos across xg_firewall, sfos. Scope summary: Sophos XG Firewall SFOS versions 17.0, 17.1, 17.5, and 18.0 prior to the 2020-04-25 hotfix, specifically when configured with HTTPS administration or User Portal exposed to the WAN zone.

Q3. What temporary mitigations or workarounds exist for CVE-2020-12271 before patching?

[Mitigation] Immediately apply the official firmware patches and disable WAN-side access to the administration interface and User Portal. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION